Customs and Border Protection Facial Recognition Program

 Customs and Border Protection (CBP) compare a traveler's face to the photo on their passport to authenticate their identity and associate the traveler with the information in the passport.  Historically, this comparison has been done by the CBP agent.  The traveler presented his passport to the agent who opened it to the traveler's photo and compared the traveler's face to the photo. This has been a time consuming, somewhat cumbersome, and error prone process.  

Now this process has been automated.  The traveler faces a digital camera and a computer compares the traveler's face to faces in its database, the database of photos that were submitted along with applications for passports (or visas).  If a match is found, the traveler has been identified.  This process is more complete, faster, more convenient, uniform, and less error prone than relying upon the capability or skill of a human agent.  

For travelers who have just been on a cruise, this identity check is all that is required.  Having been so identified the traveler can go straight to baggage claim. International air travelers may still be interviewed by an agent who will ask all the questions that agents have always asked, such as where the traveler has been, where they are going, and the purpose of their trip. The computer will show the agent all the information that is associated with the traveler in the database.  

Tests of this technology conducted over months suggest that the technology correctly identifies about 98% of travelers entering our shores.  Any exceptions are resolved by an agent using the same methods and procedures CBP has always used.  

While CBP has taken steps to incorporate some privacy principles into its program, the Government Accounting Office (GAO) has criticized its notices to travelers about the technology and particularly their failure to adequately notify travelers that they may opt out of the program and enter through the archaic procedures.

The American Civil Liberties Union (ACLU) is "alarmed" about the program.  They fear that "DHS has already laid out - and begun implementing - a clear plan to expand face surveillance."  Of course, this program is not surveillance but merely automation of an established application.  The ACLU is concerned that facial recognition technology in general is "riddled with bias and inaccuracies," and "the program will likely result in harms ranging from missed flights to lengthy interrogations or worse."  Here the proof is in the pudding.  So far, travelers endorse the program for its speed and convenience. 

The ACLU also fears that facial recognition technology "threatens to supercharge DHS's abusive practices."  Certainly there have been abuses at the border.  I caution clients to be prepared for them.  However, most have been abuses of their authority by individuals.  While I have faulted DHS and CBP for their failure to caution against these abuses, I have found no evidence that they were the result of policy or programs.  In my sixty years in information technolgy, I can recall no useful technolgy that was not been abused or misused.  

As a security practitioner, I have preferred facial recognition, and speaker recognition, to such mechanisms as fingerprint (recently shown to be less reliable than we have believed for a century https://tinyurl.com/fingerprintreliability) or even the precision of DNA.  Facial and speech, are the only two "biometrics" that can be recognized by ordinary people, even infants, better than computers.  We are wired for it.  Indeed, it is only recently that computers have achieved parity with people in recognizing. All the other biometrics have relied upon experts to  interpret them for us.   

Limitations of Biometrics

It is Blackhat/Defcon time so it should not surprise anyone that the media is full of hacks. While the hackers pretend to demonstrate that the security mechanism is useless, most of the attacks are so expensive as to be impractical.  What they really demonstrate is the limitations of the mechanism.  Regular readers of this blog know that all security mechanisms have limitations; understanding those limitations are part of our stock in trade and I write about them often.   

A recent demonstration spoofed Apple's FaceID in only "120 seconds," as though that were the only cost of attack.  They omitted the special knowledge and access.  A recent article in BankInfoSecurityNews raised alarms over the discovery of a database of fingerprint images for sale.  

First, keep in mind that biometrics are really about convenience, not security. That is why they are best used as one factor in multi-factor systems. 

Second, they do not rely upon the secrecy of the reference but upon their resistance, at least in context, to counterfeiting. Your visage is an authenticator for your drivers license. It is public information. While a photograph of you might be able to fool a computer, no other person would be likely to confuse the photo with you.  There is too little information in the photo for it to be mistaken for you.  The more information that the implementation uses, the lower the risk of false positives but the higher that of false negatives and the more power and time required for a check.  

Finally, as this article suggests, just like passwords, biometrics are fundamentally vulnerable to spoofing and replay attacks; implementations must resist them. For example, Apple's FaceID uses tests of "liveness" to distinguish between a real person and a photo of the person or a replay of an earlier submission.  Perhaps they are better used on mobiles, where possesion of the mobile is one factor and where the instant data is compared to the reference locally and does not go across a network where it could be captured for replay.  

MasterCard to Eliminate Signatures

MasterCard has announced that in the US and Canada, it will no longer require signatures on credit card transactions.  (PINs will continue to be required on debit card transactions.)   MC says that this will be more convenient for the customer and that it will rely on other (unnamed) mechanisms and processes for security.  Let us look at some.

First, many issuers use computer aided mechanisms to detect fraudulent use by looking at such clues as location and other patterns of use.  Most of us have had calls from our banks checking on the legitimacy of activity.

In theory, the required signature resists fraudulent use of lost or stolen cards.  In practice, not so much.  Even when clerks reconciled the signature on the check to the one on the card, it was an imperfect mechanism.  In modern systems, where no one really reconciles the signature, the best that the mechanism can do is to permit the consumer to recognize disputed items that he really did sign. However, for the most part, issuers simply accept the word of the consumer that a transaction is fraudulent.  The signature does not come into play. 

The best way to resist the fraudulent use of lost or stolen cards is to check that a proffered card has not been reported lost or stolen.  This works well in the US and Canada, where most transactions take place on line.  In countries where many transactions take place off line, PINs are used. 

American Express CEO, Kenneth Chennault told President Obama that Am Ex detects many fraudulent transactions within 60 seconds by sending a notification of use to the consumer’s mobile or e-mail in real time. 

Bank of America and others resist fraudulent use by permitting the consumer to turn the card on and off using an app.  Again, works well where most transactions are on line. 

Android, Apple, and Samsung Pay resist fraudulent use by simply taking the card out of the transaction and substituting a digital token for the credit card number.  Lost mobile phones resist fraudulent reuse with PINs for security and biometrics, e.g. facial and fingerprint recognition, for convenience. 

On line merchants have never had the benefit of signatures but  can resist fraud by using PayPal or other proxies instead of accepting credit cards at check out.  Where the merchants cooperate and the consumer uses Ámerican Express at checkout, AmEx will prompt the user for a one-time-password sent to the users mobile.  This protects the merchant, the consumer and AmEx.  All of these resist “card not present” fraud. 

Only the brands and issuers really know how necessary and effective signatures and PINs are: they take the risk when they are not required.

The fundamental vulnerability in the retail payment system is the credit card number in the clear on the magnetic stripe.  Remains a risk to merchants and issuers but is only a nuisance to the consumer. 

In short, the future is mobile, tokenized, cordless, contactless, signature and Pin less, and secure.