Bad science:
Now for ID cards - and the biometric blues
Sometimes just throwing a few long words about can make people think you know what you're talking about. Words like "biometric". When Alistair Darling was asked if the government will ditch ID cards in the light of this week's data cock-up, he replied: "The key thing about identity cards is, of course, that information is protected by personal biometric information. The problem at present is that, because we do not have that protection, information is much more vulnerable than it should be."
Yes, that's the problem. We need biometric identification. Fingerprints. Iris scans. Gordon Brown says so too: "What we must ensure is that identity fraud is avoided, and the way to avoid identity fraud is to say that for passport information we will have the biometric support that is necessary."
Tsutomu Matsumoto is a Japanese mathematician, a cryptographer who works on security, and he decided to see if he could fool the machines which identify you by your fingerprint. This home science project costs about £20. Take a finger and make a cast with the moulding plastic sold in hobby shops. Then pour some liquid gelatin (ordinary food gelatin) into that mould and let it harden. Stick this over your finger pad: it fools fingerprint detectors about 80% of the time. The joy is, once you've fooled the machine, your fake fingerprint is made of the same stuff as fruit pastilles, so you can simply eat the evidence.
But what if you can't get the finger? Well, you can chop one off, of course - another risk with biometrics. But there is an easier way. Find a fingerprint on glass. Sorry, I should have pointed out that every time you touch something, if your security systems rely on biometric ID, then you're essentially leaving your pin number on a post-it note.
You can make a fingerprint image on glass more visible by painting over it with some cyanoacrylate adhesive. That's a posh word for superglue. Photograph that with a digital camera. Improve the contrast in a picture editing program, and print the image on to a transparency sheet, then use that to etch the fingerprint on to a copper-plated printed circuit board (it sounds difficult, but you can buy a beginner's etching set at Maplin for £10.67). This gives an image with some three-dimensional relief. You can now make your gelatin fingerpad using this as a mould.
Should I have told you all that, or am I very naughty? Yes to both.
It's well known that security systems which rely on secret methods are less secure than open systems, because the greater the number of people who know about the system, the more people there are to spot holes in it, and it is important that there are no holes. If someone tells you their system is perfect and secret, that's like quacks who tell you their machine cures cancer but they can't tell you how: it's cobblers.
Open the box, quack. In fact you might sense that the whole field of biometrics and ID is rather like medical quackery: as usual, on the one hand we have snake oil salesmen promising the earth, and on the other a bunch of humanities graduates who don't understand technology, science or even human behaviour. Buying it. Bigging it up. Thinking it's a magic wand.
But it's not. The leak last week wasn't because of unauthorised access, it couldn't have been stopped with biometrics; it happened because of authorised access which was managed with a contemptible, cavalier incompetence. The damaging repercussions for 25 million people will not be ameliorated by biometrics.
So will biometrics prevent ID theft? Well, it might make it more difficult for you to prove your innocence. And once your fingerprints are stolen, they are harder to replace than your pin number. But here's the final nail in the coffin. Your fingerprint data will be stored in your passport or ID card as a series of numbers, called the "minutiae template". In the new biometric passport with its wireless chip, remember, all your data can be read and decrypted with a device near you, but not touching you.
What good would the data be, if someone lifted it? Not much, insisted Jim Knight, the minister for schools and learners, in July: "It is not possible to recreate a fingerprint using the numbers that are stored. The algorithm generates a unique number, producing no information of any use to identity thieves." Crystal clear, Jim.
Unfortunately, a team of mathematicians published a paper in April this year, showing that they could reconstruct a fingerprint from this data alone. In fact, they printed out the images they made, and then - crucially, completing the circle - used them to fool fingerprint readers.
Ah biometrics. Such a soothingly technical word. Repeat it to yourself.
Ben Goldacre
The Guardian Saturday November 24 2007
Guardian Unlimited
© Guardian News and Media Limited 2007
Now for ID cards - and the biometric blues
Sometimes just throwing a few long words about can make people think you know what you're talking about. Words like "biometric". When Alistair Darling was asked if the government will ditch ID cards in the light of this week's data cock-up, he replied: "The key thing about identity cards is, of course, that information is protected by personal biometric information. The problem at present is that, because we do not have that protection, information is much more vulnerable than it should be."
Yes, that's the problem. We need biometric identification. Fingerprints. Iris scans. Gordon Brown says so too: "What we must ensure is that identity fraud is avoided, and the way to avoid identity fraud is to say that for passport information we will have the biometric support that is necessary."
Tsutomu Matsumoto is a Japanese mathematician, a cryptographer who works on security, and he decided to see if he could fool the machines which identify you by your fingerprint. This home science project costs about £20. Take a finger and make a cast with the moulding plastic sold in hobby shops. Then pour some liquid gelatin (ordinary food gelatin) into that mould and let it harden. Stick this over your finger pad: it fools fingerprint detectors about 80% of the time. The joy is, once you've fooled the machine, your fake fingerprint is made of the same stuff as fruit pastilles, so you can simply eat the evidence.
But what if you can't get the finger? Well, you can chop one off, of course - another risk with biometrics. But there is an easier way. Find a fingerprint on glass. Sorry, I should have pointed out that every time you touch something, if your security systems rely on biometric ID, then you're essentially leaving your pin number on a post-it note.
You can make a fingerprint image on glass more visible by painting over it with some cyanoacrylate adhesive. That's a posh word for superglue. Photograph that with a digital camera. Improve the contrast in a picture editing program, and print the image on to a transparency sheet, then use that to etch the fingerprint on to a copper-plated printed circuit board (it sounds difficult, but you can buy a beginner's etching set at Maplin for £10.67). This gives an image with some three-dimensional relief. You can now make your gelatin fingerpad using this as a mould.
Should I have told you all that, or am I very naughty? Yes to both.
It's well known that security systems which rely on secret methods are less secure than open systems, because the greater the number of people who know about the system, the more people there are to spot holes in it, and it is important that there are no holes. If someone tells you their system is perfect and secret, that's like quacks who tell you their machine cures cancer but they can't tell you how: it's cobblers.
Open the box, quack. In fact you might sense that the whole field of biometrics and ID is rather like medical quackery: as usual, on the one hand we have snake oil salesmen promising the earth, and on the other a bunch of humanities graduates who don't understand technology, science or even human behaviour. Buying it. Bigging it up. Thinking it's a magic wand.
But it's not. The leak last week wasn't because of unauthorised access, it couldn't have been stopped with biometrics; it happened because of authorised access which was managed with a contemptible, cavalier incompetence. The damaging repercussions for 25 million people will not be ameliorated by biometrics.
So will biometrics prevent ID theft? Well, it might make it more difficult for you to prove your innocence. And once your fingerprints are stolen, they are harder to replace than your pin number. But here's the final nail in the coffin. Your fingerprint data will be stored in your passport or ID card as a series of numbers, called the "minutiae template". In the new biometric passport with its wireless chip, remember, all your data can be read and decrypted with a device near you, but not touching you.
What good would the data be, if someone lifted it? Not much, insisted Jim Knight, the minister for schools and learners, in July: "It is not possible to recreate a fingerprint using the numbers that are stored. The algorithm generates a unique number, producing no information of any use to identity thieves." Crystal clear, Jim.
Unfortunately, a team of mathematicians published a paper in April this year, showing that they could reconstruct a fingerprint from this data alone. In fact, they printed out the images they made, and then - crucially, completing the circle - used them to fool fingerprint readers.
Ah biometrics. Such a soothingly technical word. Repeat it to yourself.
Ben Goldacre
The Guardian Saturday November 24 2007
Guardian Unlimited
© Guardian News and Media Limited 2007
