Fingerprints: Pointing to the complacency trap

The world’s blossoming love affair with biometric-based security systems is in danger of leading it into a complacency trap. That’s the view of maritime security expert and former Royal Navy Officer Rod Craig, who believes that placing too much reliance on technology means greater exposure, and therefore risk, to any flaws within it.

Mr Craig, whose 35 years in the Royal Navy included time as Senior British Military Advisor to the headquarters of US Central Command and membership of the UK Joint Intelligence Committee as senior political analyst for the Russian Federation, also worked in the International Institute of Strategic Studies. There he advised on wider maritime issues such a piracy, terrorism, port security and security aspects of border control.

He can see why there’s a rush to develop and introduce the sophisticated technology associated with reading biometric data. “Security is a pressing problem, and politicians looking for a solution are able to grasp technology and ‘sell’ it to the electorate. Technology gives a feeling of security, and with that feeling comes complacency. We must not be complacent because the bad guys will find the fallibility.

“There is a feeling that technology is something at which we can throw money to develop a solution – and that’s the danger with the use of biometrics; that people see it as a solution – but on its own it never can be,” he says.

His argument is that any system will have cracks in it, and that’s what people keen to work around or through security seek to identify and exploit. An example is the introduction of personal identification numbers linked to credit and debit cards. Although they provide a further level of security, criminals soon worked out ways to extract numbers and clone the cards that go with them. “The cracks are what the bad guys are looking for,” he says.

He quickly points out the potential flaws with reading biometric keys: “For example, fingerprints can be lifted from glasses with sticky tape. We’ve all seen it done in every crime programme on the television.”

As he spoke, the ability to ‘capture’ fingerprints had been taken to another level by German magazine Die Datenschleuder, which published 4,000 copies of the fingerprint of the country’s Secretary of the Interior Wolfgang Schauble, ready to stick to someone else’s finger to provide a false biometric ‘key’. The original had been ‘lifted’ from a glass he’d used at a public meeting. Furthermore, details of how to repeat the exercise have been published on the internet. Legal action may follow.

But even though a security system based entirely on reading biometric keys is far from perfect, that’s not an argument to do nothing, says Mr Craig. “That’s not the right course of action at all, but it’s almost as unwise as rushing into action at once.”

His view is that there’s no substitute for a team of trained professionals, able to make a judgment based on their training. “Biometric technology should be a tool for such trained professionals, and not the ultimate mechanism. Trained professionals can tell when someone’s lying, or has something to hide, so there must always be human involvement,” he says. “Once you try to get to the point where it’s all automatic, then I believe it becomes a work of fiction.”

He also argues that much of the rush to biometrics is land-based, and therefore ignores the difficulties inherent in securing ports. Harking back to his involvement in European border security, he says: “The mentality was about sealing everything, but not the sea borders. Rotterdam has 43 kilometres of waterfront. Making sure something that size is protected at all times is a huge task. How can you be absolutely sure it’s being done? It doesn’t matter if the gates are guarded when the waterfront isn’t watertight.”

He also points out the dangers created by the nature of ships and the shipping industry. “The fact is obviously that ships trade worldwide. Can you trust the security of another country? If it has rules, how rigidly are they implemented? Can the country in question afford the same technology you’ve got? You can’t necessarily be certain of papers or people.

“Papers presented to port officials might be sound from countries that pay attention to such detail, but that’s not all of them. We know there are credentials out there that are dodgy, and paperwork that might not be trustworthy.”

Even in America, which is spending far more than anywhere else in the world to go down the biometric route, there are still gaps, says Mr Craig. “Before September 11 America inspected about 2% of the containers coming into Los Angeles. After September 11 they spent a great deal of money to improve testing capability, but they still inspect less than 10%. That means more than 90% are unchecked – they simply don’t have the resource or the time.”

So what is the solution? How can biometrics really play a part in making the world a safer place by allowing us to travel, but still weed out those who have no right to, or whose intentions are less than honourable?

“The use of biometric technology can be another filter, and can help to plug the gap, but must never be seen as the whole solution. There’s a huge danger in believing that high-tech is high-efficiency, and that’s not necessarily so.”

Mr Craig believes the solution lies in those trained professionals equipped with biometric technology as one of their tools, and that it can be reached by a change in mindset of those who develop and buy security systems. “Politicians like to look at solutions based on technology; when they buy technology they can see they’re getting something for their money.

“On the other hand they’re less prepared to pay for manpower, but it nevertheless remains vital. However, if you start to call men machines, and re-examine the costs on that basis, it provides an entirely different perspective.”

And another important dimension is to make sure that security systems evolve and are subject to enhancement as those who seek to defeat them develop better ways to do so. “To keep ports secure authorities simply have to keep plugging away at the problem,” he says.

“You need to be able to react on the spot with boots on the ground, holes in the water, and airframes in the air. If there are lots of trained people involved it gives the bad guys less room to manoeuvre, and any security system becomes more effective,” he adds.