Subverting Fingerprinting 169
squizzar writes in with news of a 27 year old Chinese woman who was discovered to have had her fingerprints surgically swapped between hands in order to fool Japanese immigration. "It is Japan's first case of alleged biometric fraud, but police believe the practice may be widespread. ... The apparent ability of illegal migration networks to break through hi-tech controls suggests that other countries who fingerprint visitors could be equally vulnerable — not least the United States, according to BBC Asia analyst Andre Vornic." Time for some biometric escalation. Could iris scans be subverted as easily?
Watching 'Bladerunner' too many times? (Score:3, Interesting)
However, the open question that TFA brings up is whether or not you can skin graft somebody elses fingerprints on to you. (Or vice versa). You can do allograft skin grafts, at least temporarily, so it's feasible.
Re:Watching 'Bladerunner' too many times? (Score:5, Interesting)
Or how about just carving a custom print into the finger. Maybe something like the laser surgery they do on corneas or tattoos.
Why would she do that? (Score:1, Interesting)
The thing they never talk about in these stories is what would drive someone to go to such lengths? There's rarely even a single quote from the person arrested, and yet the police can say whatever they like. What does that say about a society?
Scanners (Score:2, Interesting)
The problem isn't technology in this case, but rather bad assumptions made by the designers and users. What you're doing when you use a biometric scanner is (most often) taking a reading and converting that into a hash. And for any given hash, there will be at least one pattern that will resolve for that hash, possibly several or many. It's the same with DNA -- we can't sequence and compare a person's entire DNA, but we know certain parts of certain genes exhibit a high degree of variability, and so we sequence those and use them for comparison.
In this case, an assumption was made that fingerprints don't change on a person. Well, using lasers and surgical techniques, they can be changed, and therefore the system can be bypassed -- not because the technology is flawed, but the assumptions made about its use were. Now that this technique has been observed, we need to add another step to the identification process: Looking for scars on the fingers that suggest surgical techniques have been applied. The fingers should be carefully inspected before fingerprinting anyway -- to identify other forms of fraud as well.
Of course, there's still the human variable: Immigration necessarily requires hundreds to hundreds of thousands of personnel to administrate the rules. And the system is only as strong as the weakest link -- or the weakest person. There will always be people that can be bribed or manipulated -- or just plain lazy, and those weaknesses can be exploited. And truthfully, it'd probably be cheaper.
As long as the government walls off access to goods and services by attempting to uniquely identify people, there'll be a market for false identification. Is the price point their system has set too low?
Still the same fingerprints...? (Score:2, Interesting)
So the only way this person's surgery is actually worth anything is if fingerprint scans care which hand the prints are one? I would think that if you switched your hands' fingerprints, you'd still have the same prints, which could be picked up easily enough as long as the scan tests the prints against your right and left hands both.
Not to mention, as I'm sure someone has by now, they would probably notice the scars. I would think it would be more worth it to get someone else's fingerprints, if you could.
Fraud? (Score:3, Interesting)
Is it really fraud? Is there some promise that everyone has made to never make alterations to their bodies?
(I think it's dumb, but I don't see how it is fraud, she didn't actually impersonate anyone or anything)
What about publishing them openly? (Score:5, Interesting)
How about a public (anonymised) repository of fingerprints. The idea is this: I can't change my prints, nor can I get back control once the government has taken them. But I could publish them to the world. That makes the print very easy for anyone else to fake. In other words, plausible deniability.
Re:Did she fool anyone, though? (Score:3, Interesting)
It does add up. And some people have scars on their fingers for non-nefarious purposes. The tip of one of my thumbs was cut off in an accident and then sewn back on. I fly in and out of Japan all the time. All I need is more Mickey Mouse at immigration.
Re:Did she fool anyone, though? (Score:3, Interesting)
I has psoriasis when I was fingerprinted for a DOD lab job. My fingerprints were temporarily gone and all I had was thick smooth skin on my fingertips. I even told them I had no prints and they didn't care. My print cards looked like heel prints, they wouldn't match my hands today at all.
I also had a hard time holding onto things with smooth fingertips.
Re:Watching 'Bladerunner' too many times? (Score:2, Interesting)
There are several cases of this in the USA in the last few years.
So far they've all ended up being attributed to disease or professions that have the side effect of diminishing or eliminating fingerprints.
Having a lack of fingerprints is not illegal, but the cops excuses have always been, "If'n ya ain't got dem fingerprints, ya must be upz ta no good...".
(Extreme hick accent intended for purposes of parody.)
Re:What a security vulnerability! (Score:3, Interesting)
Just buy insurance for the stolen car.
While insurance might compensate you for your lost finger, most people are more attached to their fingers than they are to their car
And even if you're more attached to your car, this sort of system will cause you to lose both.