The Flaws and Dangers of Facial Recognition

The Flaws and Dangers of Facial Recognition

The best way to prevent your facial identity from being stolen is to limit it to airport and border security use cases

When dealing with airport and border security, we need databases, we need to share information and we need law enforcement. However, for day-to-day authentication use cases like IoT, we should resort to physiologic biometrics that rely on unique live signals. Such live signals allow for effective authentication while at the same time protecting privacy and democracy.

Problem: Facial Recognition Can be Spoofed and Hacked

By 2020 it is expected that more than one billion smartphones will feature facial recognition solutions (Counterpoint Research). In 2017, when Apple announced Face ID would be one of the newest features incorporated into the iPhone X model, it was not long before mobile phone companies followed suit. Users merely look at their smartphone screen and it unlocks, creating the most contactless mobile authentication to date. It quickly surpassed the coveted fingerprint authentication. However, it did not come without flaws.

Quickly becoming ubiquitous, study after study exposed vulnerabilities in facial recognition. Researchers from the University of Toronto were able to use adversarial learning to beat a neural net using another neural net. According to the study, by adjusting only a few pixels at the corner of a person’s eye or mouth would be unrecognizable to the facial recognition technology. Apple has set the highest standard for facial recognition with Face ID, developing a second camera called the “True Depth Camera,” which maps your face and takes special 3D pictures that are used to authenticate you with an infrared camera, flood illuminator and dot projector. However, not every device can withstand extensive tests. Dutch organization Consumentenbond found that 42 out of 110 devices tested were unlocked by using a picture of the device’s owner. Lenovo/Motorola, LG, Nokia, Samsung, and BlackBerry were all compromised.

Not only has facial recognition been spoofed and hacked, but the use of databases has added vulnerabilities, including widespread breaches. In 2018, there were many soon-to-be historic data breaches— how can we trust our facial identity is protected in this climate? Another important question: what’s stopping big companies from selling this information to the highest bidder? Nothing. In fact, Amazon offers Face Rekognition, which allows clients to build their own facial recognition system. According to Amazon’s blog post, Washington’s sheriff office has been using Amazon Rekognition since 2016 to “reduce the identification time of reported suspects from two to three days down to minutes and had apprehended their first suspect within a week by using their new system.”

Facial recognition databases can compromise democracy or be used for big data—or far worse—they can be wrong. According to a study done by the ACLU, Amazon’s Face Rekognition software incorrectly matched 28 members of Congress, identifying them as people previously arrested for a crime. Out of the 28 members of Congress wrongly identified, 40 percent of them were people of color.

Solution: Resort to Physiologic Biometrics for Everyday Use Cases to Protect Facial Identity

Facial recognition has the potential to be dangerous. In practice, we see that it can be hacked or spoofed, databases can be breached or sold, and sometimes it’s just not effective; as such, we should restrict facial recognition to viable use cases like airport and border security. In the example of airport and border security, we need facial recognition technology to use databases to make sure someone boarding a plane is not on a no-fly list. This will uphold a level of security we expect when traveling. Security and safety are not synonymous. As a society, we need to define which biometric solution will be the most successful for each given use case.

When we talk about biometric authentication for the IoT, we need to act safely, as all connected devices are susceptible to online threats. We cannot rely on facial recognition that is easily compromised by a mere picture of the device’s owner or tricked by an adversarial neural net. And, further, what is to happen if someone steals your facial identity? You can’t simply “cancel” your face like you would a stolen credit card.

We turn to the brain for answers. According to an article in Fast Company, researchers from Binghamton University used a combination of how the human brain reacts to stimuli along with the unique brain structure to create a “brain password,” a biometric solution relying on the brain’s “inexhaustible source of secure passwords.” Still in its infancy, this technology is contingent on 32 electrical sensors placed on one’s head; in the future these sensors can be put in a headset to compute accurate readings. However, there are other, less invasive ways to obtain this neural information. We can capture neuro-muscular data with high sensitivity kinetic sensors using Micro-Electro-Mechanical Systems (MEMS) present in standard mobile devices. Extracting this information can yield a stable and unique neural signature with the potential to act as our key to the IoT.

At Aerendir we believe the future of biometrics should be as frictionless as facial recognition, but as strong as “brain passwords;” with this in mind, NeuroPrint was born. While our NeuroPrint technology can extract a unique neural signal from any muscle in the body, we started with the hands due to their connection to mobile devices. We are currently focused on adding sensors and microcontrollers into the seat of a car—the possibilities are endless.

The body can truly become our own personal password, our digital identity. Our brain provides a solution that authenticates, while at the same time shielding us from preying actors. Because if our neural signal is equivalent to a one million character-long password, we can safely encrypt all of our activities and communications if we were to decide to do so.

Of course, there are other physiological biometrics that could be used, including heartbeat and voice, but using the physiological signals of the body seems to be the most promising and SAFE way to avoid the associated dangers.

Safety is not security. The IoT needs safety. Safety is, by definition, something we as users should control. The IoT has to be usercentric to be the powerful tool it is bound to be; it should never become the door of a prison, which it could potentially become if we allow facial recognition to enter every facet of our lives.

This article originally appeared in the March 2019 issue of Security Today.

Featured

  • AI to Help Resolve Non-Emergency Calls Across Utah and Decrease 911 Caller Wait Times

    The Utah Communications Authority (UCA), which oversees the state’s next generation 911 technology services, recently announced that public safety answering points (PSAPs) throughout the state plan to implement Motorola Solutions’ Virtual Response technology to automate the receipt and resolution of 10-digit non-emergency line calls in Utah with the help of AI. Read Now

  • Report Reveals Local Governments Face Surge in Ransomware Attacks with Minimal Resources

    KnowBe4, the cybersecurity platform that comprehensively addresses human risk management, recently released new research highlighting the critical cybersecurity challenges facing state, local, tribal, and territorial (SLTT) governments. The report details how government organizations have become prime targets for cybercriminals while simultaneously facing severe resource constraints. Read Now

  • Video Surveillance Trends to Watch

    With more organizations adding newer capabilities to their surveillance systems, it’s always important to remember the “basics” of system configuration and deployment, as well as the topline benefits of continually emerging technologies like AI and the cloud. Read Now

  • New Report Reveals Top Trends Transforming Access Controller Technology

    Mercury Security, a provider in access control hardware and open platform solutions, has published its Trends in Access Controllers Report, based on a survey of over 450 security professionals across North America and Europe. The findings highlight the controller’s vital role in a physical access control system (PACS), where the device not only enforces access policies but also connects with readers to verify user credentials—ranging from ID badges to biometrics and mobile identities. With 72% of respondents identifying the controller as a critical or important factor in PACS design, the report underscores how the choice of controller platform has become a strategic decision for today’s security leaders. Read Now

  • Overwhelming Majority of CISOs Anticipate Surge in Cyber Attacks Over the Next Three Years

    An overwhelming 98% of chief information security officers (CISOs) expect a surge in cyber attacks over the next three years as organizations face an increasingly complex and artificial intelligence (AI)-driven digital threat landscape. This is according to new research conducted among 300 CISOs, chief information officers (CIOs), and senior IT professionals by CSC1, the leading provider of enterprise-class domain and domain name system (DNS) security. Read Now

New Products

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.