Fingerprinting: A Word of Precaution

Fingerprints are like social security numbers—they hold the key to your identity. No two fingerprints are alike, and biometric scanners can even differentiate twins, no matter how similar they are. Biometrics not only reinforce security but also establish accessible and reliable records of employees’ work hours. Such technology eliminates fraudulent input of hours. Biometrics are also used in air travel. The Dubai International Airport has implemented state-of-the-art gates with facial and iris-recognition technology. With only a few seconds needed to identify passengers, the system helped decrease the volume of people standing in queues drastically, paving the way for efficiency. Among the many types of biometric devices, fingerprinting is the most common.   

Fingerprinting dates back to as early as 3000 BC and was used as a form of signatures for legal documents during the Chinese Han dynasty. It was not applied to forensics until the 1800s. In the painstaking endeavor of collecting 8,000 fingerprints, anthropologist Francis Galton established the fingerprint classification system which is still used today. His research further influenced the development of the ongoing Next Generation Identification project, which aims to expand the fingerprint database for law enforcement purposes. 

The undeniable link between fingerprints and identity has caused criminals to seek ingenious ways to alter them. In 1934, many newspapers circulated pictures of one of America’s most wanted, John Dillinger. He was notorious for robbing 24 banks and 4 police stations. After evading police in multiple states, he hid in Chicago and hoped to erase his former identity. For $5,000, he surgically changed his fingerprints and facial appearance, but the procedures did not change his dreaded fate and he was shot in an alley by the FBI in 1934. 

As seen in subsequent cases, mutilation can end up backfiring. In the 1930s, Chicago gangster Alvin Karpis changed his prints well enough that he struggled to obtain a Canadian passport. History repeats itself, and cases of mutilation persist in the modern era. In 2007, a doctor altered drug traffickers’ fingerprints by surgically swapping skin from the soles of their feet with their fingertips. In addition, another doctor had been caught altering undocumented immigrants’ fingerprints to protect them from detection and deportation. 

However, there are other reasons to alter fingerprints besides drug trafficking and deportation. Those who are concerned about surveillance and privacy have found an innovative way to change their fingerprints without costly surgeries. For instance, Mian Wei, a student at Rhode Island School of Design, invented an IDENTITY kit to cover fingertips with replaceable and impossible-to-copy strips. The prosthetic is actually a haphazard mess of fibers instead of the recognizable patterns of loops, whorls, and arches. 

Given the number of electronic devices with built-in touch IDs, leaked fingerprints can entail disclosure of private data. The prosthetics protect users from surveillance because some websites use fingerprinting to track web activity. Although third parties may not explicitly request the user’s permission to collect personal information, fingerprinting allows them to bypass consent. A complete history of browsing activity can be traced back to a device and then to its owner. Due to the lack of transparency about websites collecting user data, online profiles can be sold to advertisers and data companies without the user’s knowledge. As a result, insurance companies may take advantage of personal information to make inferences about a person’s health and online purchases, and this surveillance is backed up by ads related to internet history.

In Australia, controversy surrounded the employment of biometric scanners as a means of checking attendance. Some parents from East Para Primary School have expressed concerns about consent since children as young as five were required to provide their fingerprints. At an age when children rely on their parents to make the majority of decisions for them, they may not understand the consequences of providing their fingerprints. There is the possibility of using fingerprints for purposes other than attendance, but the education department reassured parents that using biometric scanners would be convenient and safe. However, the parents’ concerns about privacy are warranted. In general, schools have the responsibility of upholding the security of its biometric database, but if the system gets compromised, the school would lose its credibility and reputation. Fingerprints, for the most part, cannot be altered. After biometric information is exposed, there is little that the school can do to reverse this.

Not to mention, fingerprints are duplicable. In simple tutorial videos on bypassing touch ID, a fingerprint mold on a gummy bear grants access to a phone. Another way to hack into a phone is to place tape over the scanner and press on it, but this method works only if there are traces of the original user’s prints. In an interview with hacker Starburg, he explained how he was able to bypass touch ID in less than 48 hours following Apple’s debut of its newest iPhone. He is not critical of Apple, but he wants to spread awareness of the insecurity of fingerprint protection. “It’s akin to writing your password on a post-it note and leaving it everywhere you go,” he emphasized.   

In 2015, 5.6 million U.S. federal employees’ fingerprint images were stolen. The perpetrator is still at large but could have been a foreign government given the large scale of the breach. The theft could give adversaries an advantage in identifying U.S. spies and recruiting informants inside the U.S. government. In addition, the stolen records included personal information about friends and family, putting them at risk for privacy. As of now, there is not much that adversaries can do with the fingerprints because security has evolved with the emergence of multi-factor authentication and SMS verification. However, there are concerns that law evolves at a slower pace than technology. 

Fingerprinting has raised issues about the Fifth Amendment, which states that the suspect is protected from self-incrimination. A Southern Californian woman was ordered by a federal judge to provide access to her seized iPhone in 2015 because her boyfriend was a suspected member of the Armenian Power gang. When the literal meaning of the Fifth Amendment is analyzed, the original idea is that it protects the contents of the suspect’s mind. Under this reasoning, it is permissible for the government to obtain a key but not a password because only one of them is considered as content of the mind. Federal judges argue that fingerprints are part of the body and not the mind, hence the legality of forcing someone to provide their fingerprints. A similar case emerged in 2019, but U.S. district court judge Kandis Westmore denied a search warrant for a phone because she argued that biometric features are the same as passcodes. There is still debate over the interpretation of the Fifth Amendment.

It is important to note the ambiguous loophole in the Fifth Amendment. It can be bypassed by the “foregone conclusion exemption,” allowing authorities to seize access to electronic devices as long as the contents of the devices do not provide additional information to the evidence already collected by the police. A Philadelphia cop was jailed for refusing to decrypt his hard drives during a child-porn investigation. An examination of the computer revealed “hash” values of pornography files, so by obtaining the hard drives, the police would not gain new information. The cop has been freed because someone cannot be jailed for more than 18 months for civil contempt.   

The situation would be different for someone who used touch ID because they cannot claim to forget the password when it is their fingerprint. It is possible for the police to obtain prints from the crime scene and make a fingerprint mold. They simply need to request permission to confiscate the suspect’s device to gain access. It is debatable as to whether the suspect would be protected by the Fifth Amendment, but if fingerprints are treated as testimonial evidence, the Fifth Amendment would prevail.

There is a simple solution for preserving privacy—using biometrics in conjunction with passcodes. Using both would provide more protection than fingerprints alone. The technology to hack touch ID and improve biometric scanners go hand in hand, very much like a cat-and-mouse game. There exists no biometric scanner that is 100% secure, and hackers can craftily manipulate tools to bypass the system. One thing is for sure—be wary of the convenience and security of fingerprints.

Here are sources which I found relevant and helpful for my research:

1. Mitrefinch. (2016, July 14). Track Employee Hours Using Biometric Fingerprint Scanner. https://mitrefinch.com/blog/track-employee-hours-using-biometric-fingerprint-scanner/
2. International Airport Review (2018, January 21). Iris and Facial-Recognition Gates go Live at Dubai Airport. https://www.internationalairportreview.com/news/64213/iris-facial-recognition-gates-go-live-dubai-airport/
3. Tattoli, C. (2018, May 15). The Surprising History and Future of Fingerprints. The Paris Review. https://www.theparisreview.org/blog/2018/05/15/the-surprising-history-and-future-of-fingerprints/
4. Federal Bureau of Investigation. (n.d.). Next Generation Identification. https://www.fbi.gov/services/cjis/fingerprints-and-other-biometrics/ngi
5. White, C. (2018, September 21). Leave no Trace. The Mob Museum. https://themobmuseum.org/blog/leave-no-trace/
6. The Associated Press. (2007, May 12). Doctor Grafted Skin to Aid Drug Dealers, U.S. Authorities Say. The New York Times. https://www.nytimes.com/2007/05/12/us/12fingerprint.html
7. Daily Mail Reporter. (2011, February 11). Doctor Jailed for Plotting to Surgically Alter Fingerprints of Illegal Immigrants. Daily Mail. https://www.dailymail.co.uk/news/article-1355980/Doctor-jailed-plotting-surgically-alter-fingerprints-illegal-immigrants.html
8. Rose, J. (2016, July 6). I Replaced my Fingerprints with Prosthetics to Avoid Surveillance. Vice. https://www.vice.com/en_us/article/yp3nzb/i-replaced-my-fingerprints-with-prosthetics-to-avoid-surveillance
9. Givens, C. (2019, August 22). Device Fingerprinting and the Surveillance Economy. Avast. https://blog.avast.com/fingerprinting-and-the-surveillance-economy
10. TOTT News. (2017, January 6). Australian School Introduces Biometric Identification. https://tottnews.com/2017/01/06/australian-school-biometrics/
11. Leyden, J. (2002, May 16). Gummi Bears Defeat Fingerprint Sensors. The A Register. https://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_fingerprint_sensors/
12. Cohen, P. (2013, September 22). Touch ID Fooled–Not Hacked–by a Lifted Fingerprint. iMore. https://www.imore.com/touch-id-fooled-not-hacked-lifted-fingerprint
13. Goodin, D. (2013, September 24). Bypassing TouchID was “No Challenge at All,” Hacker Tells Ars. Ars Technica. https://arstechnica.com/information-technology/2013/09/touchid-hack-was-no-challenge-at-all-hacker-tells-ars/ 
14. Associated Press in Washington. (2015, September 23). US Government Hack Stole Fingerprints of 5.6 Million Federal Employees. The Guardian. https://www.theguardian.com/technology/2015/sep/23/us-government-hack-stole-fingerprints
15. Farivar, C. (2016, May 2). Woman Ordered to Provide her Fingerprint to Unlock Seized iPhone. Ars Technica. https://arstechnica.com/tech-policy/2016/05/should-the-govt-be-able-to-force-you-to-open-your-phone-with-just-your-fingerprint/
16. Wolff, J. (2019, January 17). Biometrics vs. the Fifth Amendment. Slate. https://slate.com/technology/2019/01/fifth-amendment-biometrics-fingerprint-search-warrant-ruling.html
17. Roebuck, J. (2020, February 8). Ex-Philadelphia Cop Freed After Years Without Charges in Child Porn Probe. The Philadelphia Inquirer. https://www.inquirer.com/news/ex-philadelphia-police-sergeant-freed-child-porn-francis-rawls-20200208.html