Your fingerprints are everywhere
By Scott Granneman, SecurityFocus
Published Thursday 16th June 2005 09:37 GMT
How much do you trust your government? That's a question that all of
us have to ask, perhaps the more often the better. In 1787, Thomas
Jefferson, one of the founders of the United States and its third
President, wrote to Abigail Adams sentences that may seem incredible
to many people today:
"The spirit of resistance to government is so valuable on certain
occasions, that I wish it to be always kept alive. It will often be
exercised when wrong, but better so than not to be exercised at all.
I like a little rebellion now and then. It is like a storm in the
atmosphere."
One way to define a government is by whom it controls; in other
words, governments serve to provide necessary services to their
citizens, like roads and armies, but governments can also legally
restrict your physical movements, your property, and your rights.
That's why someone can sue you in civil court for money, but losing a
civil suit cannot lead to your imprisonment or the loss of your civil
rights. If you have the misfortune of being tried in criminal court,
however, the state is your opponent, not an individual, and losing
that trial can result in the loss of your freedoms of movement,
property ownership, and civil rights.
There are many actions taken in the name of security by governments -
local, state, and national, and their agencies and representatives -
that are rightfully troubling to those of us who think about
security. An item was recently in the news (and believe me, it's but
one of gazillions and I could fill a book with examples like this)
that left me shaking my head and wondering just how much the people
who think they're protecting us really understand about computer
security.
The Naperville Public Library in Naperville, Illinois (the board of
which is appointed by the Mayor and approved by the City Council) is
now going to ask patrons to submit fingerprints in order to verify
the identities of patrons wishing to use the Internet terminals.
Currently, parents can ask the library to filter the Internet access
of their kids; according to the library, "filtered" kids are swapping
library cards with kids whose parents have not asked for filters, so
the little shavers are able to use the network without restrictions.
(Other examples of governmental and non-governmental organizations
asking for your fingerprints today: the Statue of Liberty,
Disneyland, the US Border Patrol, plus even some tanning salons, and
gyms.) . The Library claims that "[i]t is only the number, not the
image of the fingerprint, that is stored in the system." On the face
of it, it would be foolish for the library to lie about this, and
it's true that many, if not most, fingerprint biometric systems work
this way. But they don't have to. Couple that with the Library's
rather disingenuous assurance that "... this information is borrower
registration information and can only be revealed if required by
court order." Under the terms of the USA PATRIOT Act, however, the
FBI and other government agencies can ask libraries to reveal
information about patrons at any time, without a warrant, and the
libraries cannot reveal this snooping to their patrons.
Putting aside the fact that it's really easy to fool fingerprint
biometric schemes, Naperville's actions brings up some big questions:
How much should you know about the public library? Do you know who
runs the library? Do you trust them? Will the library really only
keep a hashed number of your fingerprint and not your fingerprint
itself? What is to prevent the FBI and other law enforcement
organizations from getting that information by using the PATRIOT Act?
What about when other governmental services, agencies, and
organizations will soon start asking for fingerprints?
It gets worse. Future passports are going to use biometrics and may
have RFID chips embedded in them (thus broadcasting American's
identities to anyone with a powerful enough RFID scanner). Do you use
encryption software on your computer to keep it secure? A Minnesota
appeals court has recently ruled that encryption software may be used
as evidence of criminal intent (putting aside the fact that every
computer out there has encryption software of some kind on it). It
seems a regular occurrance that cops hassle photographers based on
unconstitutional and, even worse, non-existent bans on photography in
public places. A 57-year-old grandma and middle school principal
forgets about the sandwich knife she put in her carry-on luggage; a
TSA employee informs her upon finding it that she is now "considered
a terrorist" and that "you don't have any" constitutional rights.
And on and on.
This is approaching madness. Money is mis-spent, impossible promises
are made, laws and decisions are rushed into being without thinking
through the consequences, and freedoms and liberties are constricted,
all in the name of security and safety. And the worst thing of all is
that most people - John and Jane Q. Citizen - have no idea at all
that their government agencies are wasting time, money, and valuable
manpower in largely futile efforts. Citizens are told by their
governments that they are safer, but in far too many ways they are
really not.
What can people who know something about security do about this? It
seems overwhelming and impossible; ignorance is a powerful force,
especially when wielded by a government. Couple that with the natural
tendency of too many people to believe those in authority -
unthinkingly! - and we've got real trouble.
Let's start small: talk to your family, your friends, your
acquaintances. Educate the folks with whom you work. When something
in the news provides you with what educators term a "teachable
moment," take advantage of that to help people understand the proper
use, and more importantly, mis-use of technology for security.
Then move outward. We can write letters to the mass media. We can try
to get interviewed by our local radio and TV stations. We can talk to
everyone we know. We can contact our representatives, at all levels
of government, and try to help them understand the difference between
real security and a false, wasteful sense of false safety. I'm not
saying it's going to be easy. It's not. Ignorance and fear have a way
of constantly subverting knowledge and bravery. But that doesn't mean
we can't rebel against them - and in this case, a little rebellion
isn't just a good idea. It's a requirement.
What are you going to do to make sure that your government really
protects you, your family, those you love and care about, and your
nation?
Scott Granneman is a senior consultant for Bryan Consulting Inc. in
St. Louis. He specializes in Internet Services and developing Web
applications for corporate, educational, and institutional clients.
---
* Origin: [adminz] tech, security, support (192:168/0.2)
generated by msg2page 0.06 on Jul 21, 2006 at 19:03:49
search: