Since its conception in the 1960s - when an MIT professor built a time-sharing computer with multiple users requiring their own private access - the generation of passwords for authenticating access to secure digital networks and devices has been fundamental. However, we can never rest on our laurels that passwords are 100% secure. 

Using spyware, hackers can crack passwords, or gain access to those that aren’t stored securely, and once obtained, they’re at risk of being shared among cyber criminals on the dark web. As a result, one of the most popular strategies for reducing the risk of a password attack is via the use of multi-factor authentication (MFA) to secure users’ credentials. 

According to the UK Government’s Cyber Security Breaches Survey 2022, 83% of data breaches were a result of phishing, so by introducing additional security components as part of an MFA solution, companies can add extra layers of protection for their users and their data. This can be done by combining a physical element, where usernames and passwords are paired with biometric information, for example, fingerprints or more commonly Face ID, or through one-time codes, or tokens, delivered through SMS or authenticators apps. 

 It’s a process that is becoming more and more commonplace, as we use Face ID to access our banking apps, or receive text messages with codes to confirm our online purchases. And now within our working environments, the evolution of the hybrid and remote office has led increasing numbers of organizations to adopt MFA protection, meaning MFA is mandated within certain industries, with governments implementing specific requirements. 

 So whether you’re required to implement a solution because of the industry you work in, or because of the partners you work with such as Salesforce, which now requires its customers to use MFA to access services, here are five factors to consider: 

1. Flexibility

Does the MFA solution apply only the required amount of security depending on the risk posed by whoever's accessing the resources? Also, does the solution offer flexible ways of authenticating users? Will it offer hardware tokens, such as a USB-based dongle, or software tokens, such as smartphone apps to NFC, to text message and push notification? Does it allow users to use biometrics, such as fingerprint scans or facial recognition/Face ID? 

2. Costs

There's a cost to implementing MFA, which is down to what option your organization chooses to implement. Hardware tokens, for example, have deployment and recurring costs, such as server infrastructure, staffing, vendor support, and hardware production and distribution. There are also costs involved with software tokens, although these tend to have fewer deployment costs, and implementation can be achieved in weeks. 

3. Security 

When implementing an MFA, there are diverse levels of security that can be used. Passwords and PINs are less secure than hardware tokens or a FIDO authenticator, which can be used when an organization needs phishing-resistant authentication to roam between devices. One-time codes offer high security when users don’t have a dedicated authentication app, meanwhile. Push notifications, too, can be a good choice if your users can use a mobile authentication app. Biometric authentication, finally, is good for system logins or specific apps. 

4. Scalability

Any MFA implementation your company opts for needs to be scalable so it can be deployed across your entire organization, and develop as the business grows. This means security practices should be consistent. Deployment should cover all end-users, whether they're in the office or working remotely. MFA should also cover cloud and on-premises applications, VPN, server logins, and privilege elevation. 

5. Ease of use

MFA should not only be easy to roll out, but should be easy to use. Some users may be limited in what they have as another factor to log into resources, such as lacking a smartphone or being unable to use a hardware token. Organizations need to balance usability with cost and security to increase acceptance. 

Whatever method you opt for, MFA is a significant addition to any security infrastructure. 

Passwords: they can be tricky at the best of times. Proper password hygiene is one of the most important factors in endpoint security, as it keeps sensitive data secure and prevents threat actors from getting into important systems.

But despite the risks, the use of weak or recycled passwords continues to be a problem even amongst IT professionals. While systems such as two factor authentication have been used as an extra layer of security, groups like the FIDO Alliance and World Wide Web Consortium have been working to make passwords a thing of the past, in favour of more secure methods.

This week, we spoke to Richard Meeus, EMEA director of security & technology strategy for Akamai Technologies, to explore the solutions driving secure sign ons, and how the sector can adapt to this change.

Highlights

“The criminals know that we are bad with passwords, and we just use something like our pet's name or something like that. And it's relatively easy for people to get the passwords or, as most commonly happens, an organisation will be breached and their password and username database will be leaked out onto the internet. And then, those usernames and passwords are reused against websites all over the planet.”

“The concept of security authentication has always been based around, sort of, one of three concepts. So there's something you know, which is a password, something you are, which is your biometric. So use your face print or your thumbprint, or something like that. Or something you have, which could be a USB token, or something that you can punch numbers into as a handheld device. So one of those three things, and we've relied upon the something you know, predominantly, which is the password.”

“Anything that we can do within security that actually makes lives easier for end users, and makes them more secure, is a good thing. And reducing passwords, reducing the use of passwords is a good thing, because nobody likes them.”

Read the full transcript here.

Footnotes

• Revealed: The top 200 most common passwords of 2022
• If not passwords then what?
• What are biometrics?
• What is two-factor authentication?
• What is multi-factor authentication (MFA) fatigue and how do you defend against attacks?
• How to implement passwordless authentication
• Best password managers
• Best free password managers
• The sooner the FIDO Alliance can shut down passwords, the better
• Will FIDO passwordless authentication save cyber security?
• The top 12 password-cracking techniques used by hackers

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

​​This automatically-generated transcript is taken from the IT Pro Podcast episode ‘Going passwordless'. We apologise for any errors.

Rory Bathgate

Hi, I'm Rory Bathgate.

Jane McCallion

And I'm Jane McCallion

Rory

And you're listening to the IT Pro Podcast, where this week we're discussing passwordless security.

Jane

Good password hygiene is one of the most important factors in endpoint security. If passwords are managed improperly, threat actors can access critical systems, and the use of weak or recycled passwords continues to be a problem even amongst IT professionals.

Rory

In place of legacy systems such as one time passcodes sent via SMS, groups like the FIDO Alliance and World Wide Web Consortium are working to make passwords a thing of the past.

Jane

Today, we're speaking to Richard Meeus, EMEA director of security & technology strategy for Akamai Technologies, to discuss the solutions that can enable more secure sign ons, and how the sector is handling this change. Richard, thank you for joining us.

Richard Meeus

Thank you very much, delighted to be here.

Jane

So everyone's been using passwords on their computers for decades. How come now they're being called insecure?

Richard

Well, I don't think it's now that they're being thought of as being insecure, I think they've been insecure for a long time. I mean, passwords have been utilised as an authentication mechanism for centuries. And it's always been fairly trivial to find out what they were. What we've been doing recently is with a plethora of websites and services, especially after the pandemic that everybody went online. Everybody reused the same passwords. People, humans, users we're rubbish at passwords, we have a limited capacity to remember passwords. And therefore we tend to use the same one repeatedly. Or we just try and be very clever and add a ‘1’ to the end, to try and make it uncrackable. And because of this, the criminals know this, the criminals know that we are bad with passwords, and we just use something like our pet's name or something like that. And it's relatively easy for people to get the passwords or, as most commonly happens, an organisation will be breached and their password and username database will be leaked out onto the internet. And then, those usernames and passwords are reused against websites all over the planet. And if you look at some of the database repositories, the legitimate repositories which are used for you to see if you have had your username and password put out onto the internet, there's about 10 million — 10 billion sorry, username and password combinations in there. That's a lot more than the internet-connected population. In fact, it's about four times more than the internet connected population. So there's a good chance there's a criminal somewhere who has your username and your password, and is trying them on a number of websites. Right now. What we want to do is move to a situation where that risk is mitigated to a certain degree.

Rory

With this risk of reusing passwords, certainly, or generating weak passwords. I know that a lot of businesses rely on things like password managers, can those be continued to be relied upon by businesses?

Richard

I think password managers, as well as with organisations looking to protect their users, it's important that password managers are used properly. A password manager is a great tool, I use one for my home business use for creating complex passwords, complex unique passwords. So I don't know what my passwords are, because they are a random bunch of 25 alphanumeric and special characters. I have no idea what they are. And the password manager remembers that, so every single asset that I talk to has a unique password. Password managers, I think, are very useful especially in the short term and within enterprises. It's not so great for end users because the vulnerable people in society, and people who are not familiar with technology, may find them quite difficult to use. But in enterprises they're certainly very useful because it allows you to create complex, distinct, unique user passwords for every single application that you go to. My passwords are often 25 characters long and a stream of unrecognisable characters, and numbers, and estimation marks, and question marks, and special characters that will be impossible to guess or impossible to do a brute force hack upon. So I think they definitely have a position, especially in the enterprise.

Jane

I mean, Richard, once again, I also use password managers. Are there risks associated with those? Recently we have seen LastPass, breached. And every time I see something like that my heart goes in my mouth. And then you realise, actually, your passwords are typically safe. But is there any kind of real chance that either the database itself could be breached particularly say, if you're reusing password for them? Or something a bit more sophisticated than that?

Richard

Well, I think a lot of the time, there's always been that concern about “if I put all my eggs in one basket, is that creating more of a risk? I think that's been the typical response to people not wanting to use password managers. But I think when you actually look at the security that is around the actual passwords, and how they're stored and how they're utilised, I think that that overweighs any of that concern about the risk about having all your passwords in one basket, or eggs in one basket. So I don't think there's a chance that if you, people do use them, I think they are very good, they're very useful. It again, outweighs the risk of just having very simple passwords that you can try to remember.

Jane

Yeah.

Rory

So in response to this, to focus on passwordless security as an option. When someone says passwordless security, I mainly think of biometric security, fingerprints, facial recognition. Is this the most promising avenue for this technology? And what are some of the other methods that are in place?

Richard

Yeah, well I mean the concept of security authentication has always been based around sort of one of three concepts. So there's something you know, which is a password, something you are, which is your biometric. So use your face print or your thumbprint, or something like that. Or something you have, which could be a USB token, or something that you can punch numbers into as a handheld device. So one of those three things, and we've relied upon the something you know, predominantly, which is the password. And we tend to use the something you have, like the USB key, or the something you are like the biometrics as an additional level and commonly called this is like two factor or multi factor authentication. So that what the concept is of going passwordless, is actually shifting away from using passwords as the primary method of authentication. And say, why do we need to use passwords as a primary, when we can use one of the other two, such as having a hardware device or using biometrics to do that first part of authentication? Obviously, there are many benefits to using the hardware device, or your thumbprint, or your face print. Because they're not likely to have the same level of simplicity around them. You know, it's not going to be quite as simple as password 123, when you're talking about your thumbprint, so there's a lot of sort of intrinsic benefit to that already.

Jane

I mean, when we're talking about this, we've sort of talked to him a little bit. When we talk about passwords you're speaking about moving the second part of two factor authentication to the front, the something you have, the something you are. Are we talking about getting rid of passwords completely, or do they become the second part of this 2FA? Or is it going to be my face and my token?

Richard

Passwords can still be used, but I would suggest that they are taken away largely completely, because they prove that they can't really be utilised effectively or securely. Certainly, if you have a three factor authentication it’s often used when you're going into very secure facilities. Where you have to sort of take in your access card, do a thumbprint, and then you have to type a PIN code in there. And then the PIN code would be sort of synonymous with your normal password. So that sort of three factor authentication will still be relevant in a lot of cases. But I think the concept of using a password to log on to a website will eventually go away, because it's not an effective way to access that level and proportionate that level risk.

Rory

And when you're talking about, I guess, in some cases this is consumers would be able to use, say a passkey, a physical passkey to verify their identity on a multitude of different accounts. In an enterprise model, could this be hard to, this specific something you have, could that be hard to implement in that if you left the company, you'd have to return what you had. It would potentially be harder than do changing a password?

Richard

Absolutely, I think the same thing you have part is an interesting concept about what it can actually be. And something, because I think everybody's sort of familiar with the, the old dongles which have the sort of rotating password pass key on them, that have been around from people like RSA for many, many years. And if you look in your desk drawer, you'll probably find two or three of them where the batteries died that you've had from many years ago. And that's not an unusual situation. And so there is an overhead to managing all those additional keys, and people will forget them, people will lose them. So there is an additional overhead in terms of that. So ideally, you want to try and use something that you already have, and you're never likely to let go of. And that's probably something like a mobile phone. And you can use a mobile phone as the something you have component. And it also allows you to do the something you are component because it allows you to do, especially with the modern smartphones, the biometrics and things like facial recognition and fingerprint recognition.

Jane

And I suppose if you've got company provided phones, then it's as easy as just returning the phone or remotely wiping it or any of that kind of thing if somebody leaves the company but they are, for whatever reason, not returning the phone.

Richard

Yes, if you're provided a company phone you will normally have some sort of MDM, some mobile device management software on the phone. Whereas as soon as they leave the company or as soon as the employment is terminated, then it's a question of just hitting a button on the central console and it would remove any of those components.

Jane

Yeah, I've thought of all kinds of nefarious things for employees to do. I think most of us more inclined to sort of lose our phone, on a train or whatever as well.

Richard

Yeah,absolutely. But also remembering that without the knowledge of where you're going, and what you're going to, because you still have to get the thumbprint to actually authenticate because it's part of that you would have something you have, something you are. Smartphones make it very easy to do two factor authentication, by taking the biometrics and the something you have. So that gives you the two factor based on that. So if you do lose your phone, they may be able to guess the pin number or the swipe pattern you have to get into the phone. But it's unlikely then they'll have the biometrics to actually get through the next level, to get on to the corporate assets as required.

Jane

Sure.

Rory

Through things like FIDO, there's been talks — I know that some manufacturers at Google Apple, Microsoft, have been in talks — to standardise this kind of technology that you're talking about. So that regardless of the hardware you were using, like the standardised keys across either your business interactions, or on a consumer basis across all of your different accounts, do you think a unified approach like that will be necessary to avoid there being a different kind of tool sprawl for businesses and consumers in the future where they're having to oh, you know, “which passkey am I going to be doing through my phone?”

Richard

I think there's going to be an argument for that. Not quite sure what things are going to happen in the short term, but it remains to be seen. I do think the work that FIDO is doing to promote easier and more secure access online is something that will be followed by more and more organisations. The current iteration, which is FIDO2, so fast identity online version two, even goes so far as to provide solutions that allow you to do phish proof MFA, because that is also a problem with MFA. It's not 100%. It's a lot better than not having multi factor authentication. But MFA is not 100%, and with the next generation, which is FIDO2, it will be phish proof. Again, it's never going to be 100%, but it's going to be a lot closer to where we want it to be.

Jane

So Richard, you've mentioned, FIDO2 briefly there. Could you tell us a bit more sort of what that's about?

Richard

Yeah, so FIDO2 is a methodology to make MFA sort of even better, because surprisingly, MFA doesn't solve all problems. You know, we think that it's going to address all of our authentication issues, but it doesn't and there's been several organisations that have been breached fairly publicly. So a very well known video game manufacturer, a well known taxi company, a global taxi company has recently been breached by what's called an MFA bypass. And an MFA bypass technique basically means that the device is talking to the website or the application, and the device that is doing the multi factor authentication are not linked. So this means that if you have stolen credentials, you can put those into the asset, put those into the website, the website will respond with an MFA challenge. And the attackers realise that the MFA challenge is going to be sent to the user, and they will try and persuade them to actually accept the challenge. And it's surprisingly easy to do that, with things like push MFA challenges. If you start sending people that at 3am in the morning, it's remarkable how quickly people will just click on ‘accept’, rather than have to listen to the bing, bing, bing, bing, bing, bing, constantly being reminded in the middle of the night. And this is what's happened to many, many organisations, is that because the device that’s making the request to the asset and the device are not linked, you can get this what's called push MFA or MFA bypass. So what FIDO2 wants to do is to locally connect the devices making the request to the origin and your external device. Now, you can do this through a USB key, plug the USB key into your device, they're now locally linked. Or you can do it through NFC, or you can do it as we do with Akamai, you can link them together through cryptographic keys. So my phone and my laptop are cryptographically linked, which basically means that the MFA is not valid unless it comes from my laptop. So if my credentials are stolen, and somebody tries to log in in another part of the world, and then tries to do a push MFA exertion on me, it won't even happen because the request has to come from my laptop. And this is what FIDO2 is doing, it’s ensuring that local MFA connectivity before it actually goes on to the next stage. And by doing this, it gets round a lot of the big MFA bypasses that have happened this year.

Jane

So this all sounds really great. And as a consumer, I can see myself adopting it. I already have, I use my thumb on my phone, people use their faces on their phone. And, you know, really consumers can turn on a penny when it comes to adopting new technology, anything like that. For businesses, it can be a little bit more difficult, especially if there's some kind of integration that they need to do with legacy systems. So how quickly can that be done? I mean, is it a problem? Am I throwing up a problem where one doesn't exist? But if I'm not, how can this be managed, and how quickly can things change?

Richard

I think with enterprise, it'll be a lot easier than it will be for consumers. For two different reasons. The main reason for consumers is that there will be a long tail of users who, for want of a better word, maybe a sort of Luddite about adopting the new technology. There are many people who don't want to have a smartphone with biometric controls on them for whatever reason. So for a service, such as public services, public sector, where they have to provide a fully inclusive service, there's gonna be a long tail of people there who won't fit into the parameters where you can do that full technology, but for multi factor authentication using biometrics or smartphone, so there will have to be solutions there to cater for those people. But with the enterprise, you have a lot more control. And you can certainly start linking all of your assets to talk to a central identity provider, be it Active Directory or some other form. And once you have authenticated with your main IDP, your main identity provider that can provide authentication tokens to every single other device within your estate, meaning once you're logged in, you're logged in across your estate. And that identity is protected by authentication through multifactor.

Jane

So the other way around to what you find quite often then, is that for businesses actually, this is quite easy. I mean, are there any sort of key hurdles that might hold up passwordless security in businesses or is it really just as easy as kind of going, “right this is our, you know, the method that we do now internally, at least. And, and off we go”?

Richard

There's always going to be some legacy applications that don't have the ability to use authentication. So there's a functionalities like OAuth, which allows applications to be authenticated elsewhere. If they don't have the functionality to have that capability, then you're going to have to have another way of authenticating with those legacy applications. So it's not necessarily going to be applicable across the board. But most modern organisations will have the facility to deploy the majority of their applications through that one password, or one authentication process, and then being able to pass that assertion through to all the relevant applications.

Rory

Do you think that implementing a system like this might also help with oversight of who has access to which systems? Because currently, obviously with passwords, it's very easy within an organisation for someone to ping a password across on a Google chat to someone who maybe shouldn't have access to, to a back end system. So using authenticators might also improve observability across the system?

Richard

I think there's a potential for that, I think that where that particular area’s going is more into is looking at the authorisation component. So with identity, you’ve got the identification, which is the username, you've got the authorisation. Sorry, the authentication, which is the something you are, something you have, something you are. And then there's the authorisation component, and authorisation is something that's being looked at when you look at things like zero-trust network access, which is a way of giving users access just to applications that they need. So it's really sort of going down heavy on lease privilege. This is a really good way to ensure that only the users authorised to access an application, get that level of access. Which means that anybody else does not have that level of access. So, if you gave somebody else a password, you'd have to have the username and have the password, but they still wouldn't be authorised, they still wouldn't physically be able to get to that particular asset. And I think that's why a lot of organisations are looking into it. Because I know zero trust is a word that bandied around a lot with, with wanton carelessness, sometimes, but it fundamentally comes down to lease privilege, which is something that IT professionals have been familiar with for many, many years. And that's where it's trying to get to, if you don't have the right identity, authentication and authorisation, you can't actually get to that application.

Jane

So Richard, if the worst does happen, and a business is hit by a cyberattack, can using a passwordless solution help minimise the impact? Or does it just minimise the risk?

Richard

That's a really good question. I think initially, it minimises the risk. Because I think if you, there was a report I think in the Verizon data breach incident report last year, that credential vulnerabilities were responsible for 84% of all breaches. So if you can get to addressing that vulnerability, that reduces the risk significantly of having a breach. So I think that's the first aspect. Once somebody has got inside your organisation, then absolutely, having good identity controls is in place, but it's a little bit late at that point, you then need to be looking at other security elements to be able to protect your organisation. And that can be through things like zero trust, network access, or micro segmentation to throw another technology into the mix to prevent them moving laterally through your organisation. But I think this is where passwords can be used, especially within the enterprise as part of a layered security model of trying to reduce the risk at all levels, reduce the level at authentication time, reduce the risk at connection time, whether connecting via IP or just the application layer, and then reducing the risk of moving throughout an organisation when deployed as part of a managed strategy, then you're able to reduce the risk at all levels as best as possible.

Jane

Yeah, and I think you've kind of hit on something important there really, which is whether this is passwordless or really any other kind of security technology, or any technology, that it's not a panacea, it's not a cure-all, it has to be used as part of a wider security strategy. Whether that's training or like you say, other technologies that can help the progress or at least to slow the progress of anybody who's staging an attack. Is that a fair observation?

Richard

Absolutely. I think that there aren’t many things that as security professionals we can do, that actually makes things easier for end users. Normally, we are seen as the Department of No, the Fun Police. So I think that anything that we can do within security that actually makes lives easier for end users, and makes them more secure, is a good thing. And reducing passwords, reducing the use of passwords is a good thing, because nobody likes them. Nobody likes them, nobody likes trying to have to remember them. There's always a challenge, there’s always some times you forget, or whatever. It's a problem. It's a massive security risk. So getting rid of that pain point from users would be a boon I would say.

Rory

So you think that there's real potential for this to improve, maybe, productivity within the workforces? Or at least improve the use of access for vital systems within workforces?

Richard

Absolutely. I think when you look at most organisations where you have, you know, probably thousands of applications within an organisation, although most users will only have access or need to use 10 or 20 of them. The ability to reduce the access to just the applications you need, and the ability to have to worry about a password is fantastic. At Akamai we've been passwordless for many years now. So I don't use a password to log on. I don't use a password to access applications, it's just all done through passwordless technology. And that makes it a lot easier for me not having to worry about, “oh, I need to access that particular system. Where is it located? What password do I need?” All that, it's a lot easier to use? And yes, it's anything that gets rid of that, “oh, what's the password for that application that I haven't used for two months?” Anything gets around that problem, which everybody has, if you can get if you can solve it, it's bound to help all sorts of users.

Jane

So Richard, at Akamai you are ahead of the curve. But how far away do you think we are from universal adoption of this kind of security across businesses?

Richard

I think that's a very difficult question. Because there are many companies and many verticals that are on all sorts of that journey, all different areas of the passwordless adoption journey. I think people will want to go there because the benefits are manifold. But there is always going to be an issue with inclusivity. Because you have to make sure that everybody is catered for. And if you can't cater to everybody, then there's always going to be an issue. So in the consumer space, I think it's going to be utilised to enable users, I still think you're going to have to have passwords for inclusivity. But if you're using it in the consumer space, and you want to get access to all of your favourite music sites, or TV sites, or shopping sites without having to remember a password all the time, I think people are going to embrace that. And that it will be seen as a benefit not only for the consumers, but also the vendors as well. In the enterprise space, I think that organisations will want to go down this level to a certain degree, I think there's always going to be legacy applications that won't suit that. Or the infrastructure will not benefit it as a whole. But I think overall, it's certainly a methodology that will be broadly adapted. The big vendors, as you mentioned at the beginning, are doing this. Microsoft has things like Microsoft Hello, which allows you to do passwordless authentication. It's something that's being adopted through many different vectors, so it will increase. Am I going to put a date on it and say you have no more passwords in five years. That’s a crystal ball I would love to have, but I couldn't say that.

Jane

No fun, no fun.

Rory

Well, Richard, thank you so much for being on the show.

Richard

Thank you Rory, thank you Jane. It's been a pleasure. Thank you very much indeed for having me.

Jane

Thank you. As always, you can find links to all of the topics we've spoken about today in the show notes and even more on our website at itpro.co.uk

Rory

You can also follow us on social media, as well as subscribe to our daily newsletter. Don't forget to subscribe to the IT Pro podcast wherever you find podcasts. And if you're enjoying the show, leave us a rating and a review

Jane

I will be back next week with more from the world of it but until then goodbye.

Rory

Goodbye

A team of researchers from the University of Cambridge have called for UK police to be banned from using facial recognition in public spaces, and claimed that police deployment of the tech to date has not met “minimum ethical and legal standards”.

Researchers analysed three instances of facial recognition technology (FRT) used by UK police - two from South Wales Police and one from the Metropolitan Police Service (MPS) - and found that in every case FRT could infringe upon human rights, falling short of ethical and legal standards.

A group from the Minderoo Centre for Technology and Democracy created an audit tool to weigh the examples against a number of legal standards, as well as measurements of technical reliability, human decision-making and expertise.

Legal standards included the Data Protection Act (DPA) 2018, Human Rights Act 1998, and Equality Act 2010.

In response, the authors of the study have recommended that others apply its audit to other instances of police FRT. This could then build evidence to inform potential litigation efforts and lend its support to the prevention of police FRT use in public spaces.

“There is a lack of robust redress mechanisms for individuals and communities harmed by police deployments of the technology,” said the lead author Evani Radiya-Dixit, who is a visiting fellow at Cambridge’s Minderoo Centre.

“To protect human rights and improve accountability in how technology is used, we must ask what values we want to embed in technology.”

The report also concluded that UK police have consistently refrained from consulting the public, and marginalised communities in particular about the use of FRT, nor published transparent data on the use of FRT to allow for independent scrutiny.

Use of live facial recognition (LFR) by the MPS between August 2016 and February 2019, one of the three case studies assessed by the authors, was highlighted as a particular example of this lack of transparency.

"While MPS published some demographic data in their results, they did not record the demographic breakdown for engagements, stop and searches, arrests, and other outcomes resulting from the use of LFR,” read the report.

“This makes it hard to evaluate whether LFR perpetuates racial profiling. There was also no published evaluation of racial or gender bias in the technology. MPS conducted an internal evaluation but did not disclose the results. This lack of transparency makes it difficult for outside stakeholders to assess the comprehensiveness of the evaluation."

The report’s authors cited research that has shown FRT to perform noticeably worse on marginalised groups. They stated that under the Public Sector Equality Duty of the Equality Act 2010, police are required to acknowledge that live facial recognition carries bias against people of colour, women, and people with disabilities.

"We would have welcomed the opportunity to have spoken to the researchers of this report and to share with them our latest data, legal framework and the arrests made as a result of live facial recognition operations," an MPS spokesperson told IT Pro.

"Between August 2016 and February 2019, we trialled LFR in different situations, to allow us to learn and progress / develop its use before launching it in January 2020, with publicly available documents covering legal, data and equality issues on our website.

"We continue to review and assess our use of this important tool, including its demographic performance."

Proportionality was also raised as an issue, with South Wales Police found to have retained custody images on a facial recognition watchlist without clear limits on the seriousness of the offences of those included.

The authors argued that this was used disproportionately in combination with operator-initiated facial recognition (typically carried out on a mobile phone) and that the watchlist also included unlawfully-retained images of innocent individuals who were arrested but never convicted.

South Wales Police told IT Pro that a Court of Appeal judgement in 2020 highlighted some areas that needed improvement, and the force has begun trialling experimental deployments to test the proposed mitigations. The results of these trials will be known later this year, a spokesperson said.

“The legal challenge to our use of this ground-breaking technology through the courts has enabled us to ensure that its use is responsible, proportionate and fair,” said assistant chief constable Mark Travis.

“The whole aim of using facial recognition technology is to keep the public safe and assist us in identifying serious offenders in order to protect our communities from individuals who pose significant risks.

“I believe the public will continue to support our use of all the available methods and technology to keep them safe, providing what we do is legitimate and proportionate.”

Police use of facial recognition has become a commonly raised issue among rights campaigners, with the use of live facial recognition (LFR) particularly controversial in its deployment.

The Ada Lovelace institute published a report in June, which called for new regulations on biometric data processing in the public and private sector, and recommended the creation of an independent Biometrics Ethics Board to whom public bodies would have to justify their use of biometrics technology.

Private companies have also prompted complaints from within government for their use of facial recognition tech. In July, a cross-party group of MPs signed a letter calling for a ban on two prominent Chinese CCTV firms’ use of facial recognition, stating that the widespread use of their equipment in public buildings constituted a national security risk.

This article was updated to include comments from the Metropolitan Police Service and South Wales Police.

Snap Inc., parent of instant messaging app Snapchat, has reportedly agreed to pay a $35 million settlement as part of a class-action lawsuit claiming it broke a key piece of Illinois privacy law.

Snapchat, the image-based messaging app that gained popularity in the 2010s, is also known for its wide array of lenses, which humorously alter a user’s appearance within a photo or video.

The complaint claimed that by “scanning the geometry of a person’s face” to apply the lenses, Snapchat is in violation of Illinois’ Biometric Information Privacy Act (BIPA). The plaintiffs were seeking $1,000 per negligent violation, and $5,000 per reckless violation.

BIPA prohibits private entities from collecting or obtaining a person’s biometric identifiers or information without first informing them in writing that this will occur, as well as outlining how long the data will be used and what for, and publishes its schedules and guidelines for destroying data.

Snapchat refutes the claim that it stores biometric data.

“While we are confident that Lenses do not violate BIPA, out of an abundance of caution and as a testament to our commitment to user privacy, earlier this year we rolled out an in-app consent notice for Snapchatters in Illinois,” Snap spokesperson Pete Boogaard told The Verge.

It remains a widely used social media platform, with over 88 million users in the US alone, according to Statista. However, user figures dramatically increase in younger age groups, with Snapchat itself claiming that over 75% of 13-34 year olds in over 20 countries today use Snapchat.

The settlement covers a broad time span, as any Snapchat user based in Illinois, who used its filters and lenses since November 17 2015, might be eligible for a payout. Individuals looking to submit a claim form have until 5 November to do so.

Unlike the UK or EU, the US has no federal data privacy legislation, instead relying on sets of local legislation that vary by state, as well as court convention.

The BIPA is a stringent piece of legislation, which sets out strict guidelines for the collection of biometric data. In June, Google was also hit with a lawsuit claiming that it had violated rights established by the BIPA, over the use of facial recognition in the Google Photos app. Without admitting wrongdoing, Google settled the suit in a $100 million payment.

Concern over the transparency of social media apps is a pressing issue, with apps such as TikTok having been accused by the FCC commissioner of being a China-backed surveillance tool, collecting sensitive information from US citizens.

Last week, it was announced that Oracle would be fulfilling a long-planned agreement with TikTok to receive and manage all of its US user traffic, and would regularly audit the company’s algorithms and use of data.

The Home Office is planning to fit migrants who have committed a crime with smartwatches containing facial recognition technology, with which they will be required to scan their faces up to five times per day.

Migrants fitted with the devices will be expected to complete regular checks, such as taking a photo of themselves for data processing at points throughout each day.

Their names, date of birth, nationality, and facial recognition data will be stored, and checked against a Home Office database, for use in determining whether or not a manual check is required. Location data of those wearing the smartwatches will also be constantly recorded.

Collected data will be stored for up to six years, and during this time will be shared between the Home Office and the Ministry of Justice and the police.

Use of a database to cross-check daily photos of migrants to facial recognition data was not expanded upon, but the Metropolitan Police Service has a controversial history of using facial recognition databases, having been discovered surveiling passengers at King’s Cross in 2019 for that purpose.

According to a letter seen by The Guardian, the Home Office pressed ahead with plans for “daily monitoring of individuals subject to immigration control” after completing a data protection impact assessment (DPIA) in August 2021.

Under the General Data Protection Regulation (GDPR), organisations seeking to implement new systems that could infringe upon the rights of subjects must run a DPIA, in which the data controller assesses the risks of processing data on subjects.

Rights groups have been vocal about their objection to the collection of facial recognition data, both in regards to the invasion of privacy that they see it as representing and also in doubt of the degree to which the technology can be relied on. Big Brother Watch state that between 2016 and 2022, facial recognition used by the Metropolitan Police Service was 87% inaccurate.

The scale of the operation is not currently public knowledge, though the contract signed between the Ministry of Justice and Buddi Limited is valued at up to £6 million by 30 December 2023.

Home Office data for the year ending June 2021 shows that 2,809 foreign national offenders (FNOs) were returned from the UK that year, a number that would prove sizeable to track if all FNOs were chosen for the smartwatch programme.

In June, an independent legal review by the Ada Lovelace Institute urgently called for new legislation to regulate the use of biometric data, as well as recommending the creation of a biometric ethics board.

In contrast, the government’s proposed Data Reform Bill, which ministers have credited with cutting down the “red tape and pointless paperwork” of GDPR, seeks to reduce the need to seek user consent in certain circumstances, including data processing by criminal justice organisations and police forces.

“The Home Office is still not clear how long individuals will remain on monitoring,” Dr Monish Bhatia, a lecturer in criminology at Birkbeck, University of London, told the Guardian.

“They have not provided any evidence to show why electronic monitoring is necessary or demonstrated that tags make individuals comply with immigration rules better. What we need is humane, non-degrading, community-based solutions.”

IT Pro reached out to the Home Office for a statement. Buddi Limited declined to provide comment.

Privacy rights group Big Brother Watch has issued a legal challenge with the Information Commissioner's Office (ICO) against the Southern Co-operative supermarket chain for its use of cameras that capture biometric data of customers.

Facial recognition technology sold by surveillance firm Facewatch is currently used in 35 of Southern Co-operative’s 200 shops. Big Brother Watch claim that this system is unjustified.

When a customer enters the shop, their face is converted into biometric data and checked against a ‘blacklist’ to produce an alert in the presence of certain shoppers.

According to the group, staff can add customers to a facial recognition ‘blacklist’ without first informing them.

In the blog post announcing the move, it alleged that Facewatch documents state customers who are not added to such a list may still have their face data stored for several days to improve the facial recognition system.

Big Brother Watch claims that this “uses novel technology and highly invasive processing of personal data, creating a biometric profile of every visitor to stores where its cameras are installed”.

Southern Co-operative contends that facial recognition is only used to protect staff against customers who have previously been noted as having shoplifted or been violent with staff.

Big Brother Watch seeks an ICO ruling on whether this using facial recognition technology in this way is necessary to prevent crime.

In a statement to the BBC, Southern Co-operative defended its use of the technology and rejected suggestions that it is not respecting customers’ biometric data.

"We take our responsibilities around the use of facial recognition extremely seriously and work hard to balance our customers' rights with the need to protect our colleagues and customers from unacceptable violence and abuse," it stated.

Staff do not interact with photos directly, only with biometric profiles. A single camera by the door of each shop is used to capture images of customers entering the premises.

Facewatch also spoke to the BBC and defended the use of their cameras in shops.

"Facial recognition may be used where it is necessary because other methods to prevent crime, such as policing, CCTV and manned guarding, have tried and failed,” they stated.

"Any privacy intrusion is minimal and proportionate. Facewatch is proven to be effective at crime prevention, and our clients experience a significant reduction in crime."

Biometric data collection is a hotly contested issue right now. Earlier this month, a cross-party group of MPs signed a letter calling for two prominent Chinese CCTV companies to be banned from the UK use citing privacy and ethics concerns.

The director of Big Brother Watch, Silkie Carlo, took the group’s press release as an opportunity to condemn the practice in the strongest terms.

“The Southern Co-op’s use of live facial recognition surveillance is Orwellian in the extreme, highly likely to be unlawful, and must be immediately stopped by the Information Commissioner.

“The supermarket is adding customers to secret watchlists with no due process, meaning shoppers can be spied on, blacklisted across multiple stores, and denied food shopping despite being entirely innocent.

“This would sound extreme even in an episode of Black Mirror, and yet it is taking place right now in Britain.”

Amazon’s Ring doorbell unit has admitted to providing police forces with data without users' consent 11 times so far this year, according to a prominent US politician.

Democratic senator Edward Markey released the findings from his probe into Ring, which highlighted the close relationship between the company and law enforcement, according to a letter the senator received from the company.

The company said it provided the videos to law enforcement in response to emergency requests. It said that in each instance, Ring made a good-faith determination that there was an imminent danger of death or serious physical injury to a person requiring disclosure of information without delay.

"It’s simply untrue that Ring gives anyone unfettered access to customer data or video, as we have repeatedly made clear to our customers and others," a spokesperson for Amazon's Ring said in a statement. "The law authorises companies like Ring to provide information to government entities if the company believes that an emergency involving danger of death or serious physical injury to any person, such as a kidnapping or an attempted murder, requires disclosure without delay. Ring faithfully applies that legal standard."

The doorbell unit also revealed that its Neighbors Public Safety Service (NPSS), a platform that allows police and others to ask Ring owners for footage, currently has 2,161 law enforcement agencies and 455 fire departments enrolled. This represents a more than five-fold increase in law enforcement partnerships on the platform since November 2019.

“As my ongoing investigation into Amazon illustrates, it has become increasingly difficult for the public to move, assemble, and converse in public without being tracked and recorded,” said Markey. “We cannot accept this as inevitable in our country. Increasing law enforcement reliance on private surveillance creates a crisis of accountability, and I am particularly concerned that biometric surveillance could become central to the growing web of surveillance systems that Amazon and other powerful tech companies are responsible for.”

The senator has called on Congress to pass the Facial Recognition and Biometric Technology Moratorium Act to stop law enforcement from accessing sensitive information about citizens’ faces, voices, and bodies.

Ring also refused to commit to not incorporating voice recognition technology in its products. It stated that only police and fire departments are on NPSS, despite the company’s commitment to actively recruit public health departments, animal services, and agencies that primarily address homelessness, drug addiction, and mental health onto Ring’s platform.

The doorbell unit failed to clarify the distance from which Ring products can capture audio recordings and refused to commit to eliminate Ring doorbells’ default setting of automatically recording audio, stated the senator. The company also refused to commit to make end-to-end encryption the default storage option for consumers.

"It takes a lot of nerve for Amazon's Ring to promise a sense of safety to the face of its customers only to go around their backs giving away their private footage to the police without consent," said Nuno Guerreiro de Sousa, a technologist from Privacy International. "Allowing police to skip due processes such as warrants is not making anyone safer, one the very contrary, it opens extremely dangerous precedents."

In 2019, over 30 civil rights organisations wrote an open letter that called on government officials to investigate Amazon Ring’s business practices and end its numerous police partnerships. The letter added that Amazon is able to vacuum up enormous amounts of data which is then used to bolster Amazon’s corporate interests, often at the expense of local businesses and smaller competitors.

“Amazon’s latest encroachment with the Ring-police partnerships exemplify the company’s willingness to do what it takes to expand their data empire,” the organisations said. “Once they have this data, there is nothing stopping them from using it for their own profit-driven purposes.”

In a clear message to all companies collecting individual data, the Federal Trade Commission (FTC) has reaffirmed its commitment to harshly enforce illegal breaches of sensitive information.

The FTC notes in a blog post there's a litany of information that can be collected to categorise and identify people’s medical histories, which has potential for dangerous exploitation particularly in the case of consumers seeking abortions.

In light of the recent ruling by the Supreme Court to overrule Roe v Wade, the decision which had protected the right to choose to have an abortion, misuse of sensitive data is a point of fierce discussion.

The regulator cited cases such as that of Copley Advertising LLC as early examples of what could be a growing trend. The company had been utilizing location data to identify people entering within a certain range of clinics offering abortion in several states, and then targeting them with anti-abortion advertising.

It has since reached a settlement with the Massachusetts Attorney General for misuse of geofencing for advertising purposes.

Striking a tough tone against potentially unethical firms, the FTC further outlined its powers to not only fine companies in breach of data protection legislation, but also require them to delete data they have collected as well as any models made with the data.

People’s information can be collected and misused in more ways than one, and the post is careful to focus on the potential for information that consumers willingly track — such as blood sugar level, menstrual cycle, sleep patterns and contraceptive use — in addition to less flagged data points such as location.

Unlike the EU and UK, the US has no central data protection legislation, nor is there an explicit right to privacy within the US constitution. Instead, a range of laws and constitutional rulings cover consumers’ right to privacy, making up a complex tradition of protections that vary state-by-state.

Currently, some of the widest such legislation includes rules that the FTC enforces such as the Health Breach Notifications Rule, which states that “vendors of personal health records and related entities to notify consumers following a breach involving unsecured information”. Violation of the rule can result in a fine if up to $46,517 per violation per day.

Many rights groups argue these rules are inadequate and subject to loopholes such as legitimate sale of information to third-party brokers. The non-profit organisation Planned Parenthood has called for a federal data protection law to codify regulation of such data into law and prevent misuse by advertisers. Biometric data law is a particularly contentious issue, with similar calls within the UK right now for more transparent consumer protections around what data companies can track, and why.

In the post, the FTC specifically warns against misleading claims of ‘anonymization’ by companies, pointing out that such data can frequently be re-identified. Knowingly making such false claims to placate customer concerns around privacy will trigger FTC intervention, it asserts.

“The Commission is committed to using the full scope of its legal authorities to protect consumers’ privacy. We will vigorously enforce the law if we uncover illegal conduct that exploits Americans’ location, health, or other sensitive data,” stated the agency in the blog post.

“The FTC’s past enforcement actions provide a roadmap for firms seeking to comply with the law.”

Softbank is under pressure after it emerged one of its subsidiaries, which indirectly sells to prominent US enterprises, may use facial recognition systems sourced from a Chinese company blacklisted by the US government.

Japan Computer Vision Corp (JCV), which is owned by Softbank, provides facial-scanning systems to clients such as Mastercard and Visa through an intermediary third-party company. Both companies seek to use biometrics at checkout to increase security for their customers.

Reuters, however, reports that JCV utilises technology developed by SenseTime Group, a Chinese firm that was sanctioned by the US government in December for alleged links to human rights violations in the Chinese province of Xinjiang.

This has led to concerns that SoftBank will soon face difficult regulatory challenges. Although JVC remains fully compliant in Japan, the US is reportedly taking issue with the fact technology provided by one of its technology partners is indirectly being supplied to American companies.

Softbank told IT Pro that JVC develops its own systems for the Japan market, and that Visa and Mastercard are not direct customers, but are indirect customers through another company's system. A spokesperson added JVC's systems, including those supplied by SenseTime, are fully compliant with local facial recognition and privacy laws.

Softbank's planned sale of Arm to Nvidia fell through in February of this year, in part due to regulatory hurdles led by the UK Competition and Markets Authority (CMA) alongside pushback from the US Federal Trade Commission.

The use of biometric data is a hot issue, with independent research institutes such as the Ada Lovelace Foundation calling for heavy regulation of biometric technology. MPs have also argued for stricter restrictions on firms that can operate equipment such as facial recognition cameras within the UK.

Softbank also said SenseTime is a technology partner kept separate from the dealings with Mastercard and Visa, and has no access to their systems or data.

No allegations have been made that JCV itself is violating any laws or restrictions, and the firm asserts their tech is audited by a third-party cyber security company based in Israel, CYE. The firm is led by the co-founder of the Israel Defense Forces’ (IDF) Red Team, and assesses JCV’s data security and their opt-in facial recognition systems.

The main concerns stem from association with SenseTime. In the 2021 sanctions announcement, the US Treasury formally accused the company of assisting in the creation of technology to identify and categorise minorities in China.

“SenseTime 100% owns Shenzhen Sensetime Technology Co Ltd, which has developed facial recognition programmes that can determine a target’s ethnicity, with a particular focus on identifying ethnic Uyghurs.

“When applying for patent applications, Shenzhen Sensetime Technology Co Ltd has highlighted its ability to identify Uyghurs wearing beards, sunglasses, and masks,” read the US Treasury statement.

SenseTime denies these claims, and indicated to Reuters that it seeks to both strengthen its relationship with JCV. It's also established an internal ethics council to meet standards in the markets in which it operates.

An independent legal review has concluded that new laws regulating the use of biometric data in the public and private sector are urgently needed.

The report, commissioned by The Ada Lovelace Institute and undertaken by Matthew Ryder QC, aimed to highlight the uncertain level of biometric technology regulation provided by existing laws such as the EU's General Data Protection Regulation (GDPR).

Among the review’s recommendations are a new statutory framework to set out the use of biometric data by private and public organisations for both identification and classification, and the establishment of a national Biometrics Ethics Board. This, it says, is necessary given the rights-intrusive potential of new technologies such as live facial recognition and gait recognition.

Further investigation into the private sector’s use of biometrics, as well as the sharing of information between private and public sector entities, was also highlighted as a matter of importance.

The review gives the example of the use of facial recognition technology at the King’s Cross site in 2019, which was later found to have included a data sharing agreement with the Metropolitan Police and British Transport Police, to “prevent and detect crime in the neighbourhood”, according to the site's owners.

Recommendations in this area include stricter regulation of Live Facial Recognition (LFR) and a complete moratorium on all LFR in both the public and private sector until the new framework is in place.

Additional concern was raised around the use of remote monitoring and video processing to collect biometric data in the private sector, enabled by the rise of remote working throughout the pandemic.

Under current protections provided by GDPR, biometric data is only classified as special category data when it is collected for ‘the purpose of uniquely identifying a natural person'. The Ada Lovelace Institute, in their policy report supplemental to the review, notes that this leaves biometric data used to determine a person’s “gender, race, or emotional state” subject to less stringent legal oversight.

Proposed legislation would cover use of biometric data for identification and classification. It would also require biometric technology earmarked for public use to first undergo a series of impact assessments to determine its potential impact on privacy and equality, as well as scrutinise the necessity and proportionality of the technology.

Public bodies would then have to refer any such technology to a newly proposed Biometric Ethics Board, the creation of which would provide ethical oversight in a public advisory capacity. It was also suggested that the advice of the board should be made publicly available, with public bodies required to publish explanations for any decisions made contrary to this advice within 14 days of any such decision.

Having begun in 2020, the review makes no reference to the proposed Data Reform Bill, which has been specifically highlighted by government ministers as relaxing certain restrictions imposed by GDPR that they dubbed “red tape and pointless paperwork”. These include aims by the government to cut down on the need to seek user consent for the processing of data in certain circumstances.

As part of the review, the Ada Lovelace council convened a Citizens’ Biometrics Council, composed of a diverse group of 50 members of the public asked to learn about and offer views on the use of biometric technology in legislation. A common view in their recommendations was the need for consent and transparency regarding the use of biometric data.

The Unique Identification Authority of India (UIDAI) withdrew advice yesterday advising citizens on how best to secure their Aadhaar national identity cards.

The Aadhaar system is used in India to provide a single source of identity verification across the country for its residents. Once enrolled, citizens can use their Aadhaar number to authenticate and establish their identity multiple times using electronic means or through offline verification, according to UIDAI. Linked to a citizen's biometric data, it's used for accessing social welfare schemes, opening bank accounts, dispersing pensions, passport applications, and more.

UIDAI’s Bengaluru office warned the general public last Friday to not share a photocopy of their Aadhaar with any organisations as it can be misused. Alternatively, a masked Aadhaar can be used instead, which displays only the last four digits of the card’s number, which can be downloaded from the UIDAI official website.

UIDAI also asked the public to avoid using a public computer at an internet cafe to download their e-Aadhaar. “However if one does so, it should be ensured that all the downloaded copies of e-Aadhaar are permanently deleted from that computer,” it advised.

The warning added that only those organisations that have obtained a user licence from the UIDAI can use Aadhaar for establishing the identity of a person. Unlicensed private entities like hotels or film halls aren’t permitted to collect or keep copies of the Aadhaar card, or seek a photocopy of the card, it said.

This provoked a response on social media, with one user saying that they have stayed in around 100 hotels which kept a copy of their Aadhaar.

Following the uproar, the UIDAI released a clarification two days later, on 29 May. It stated that its Bengalaru office issued the warning as there was an attempt to misuse a photoshopped Aadhaar card.

“The release advised the people to not to share photocopy of their Aadhaar with any organisation because it can be misused. Alternatively, a masked Aadhaar which displays only the last 4 digits of Aadhaar number, can be used,” it stated.

However, it added that given the possibility of the misinterpretation of the press release, the message is withdrawn with immediate effect. Card holders are only advised to exercise normal prudence in using and sharing their UIDAI Aadhaar numbers.

The system has been a cause for concern in the past, with critics worried about its security and surveillance capabilities. In 2018, India’s Supreme Court upheld the validity of the system, saying sufficient security measures were taken to protect data and it’s difficult to launch surveillance on citizens based on Aadhaar. However, the judges asked the government to provide more security measures as well as reduce the period of storage of data.

The drive to kill passwords has been underway for years, with companies including Yahoo and Microsoft campaigning to bring passwordless authentication into the mainstream. Critics have argued passwords are surprisingly insecure, especially in light of modern, relatively fool-proof innovations.

Altogether ditching what’s been a fixture in the realm of computing for decades, however, might seem daunting. With uncertainty, yet remaining around advents such as biometrics, it’s little surprise that businesses, in general, have refrained from moving away from passwords in any meaningful way.

To clarify some of the anxieties, and the mystery, surrounding passwordless authentication, we’ve summarised the most pressing questions that might come to mind when you consider eliminating passwords from your business.

Passwordless authentication: Logging in without a password? That doesn’t sound very secure

On the contrary – done properly, it’s more secure than a traditional username and password combination. The idea is, rather than relying on a phrase that could be typed in by anyone, you use something physically tied to you. That might be a biometric identifier – such as your fingerprint or the shape of your face – a physical device such as a USB key, or an app running on your mobile phone, which is itself secured with biometrics. Most passwords, nowadays are obtained by phishing attacks, or by stealing a database of credentials from poorly protected ‘service A’ and then trying them all on ‘service B’, to see if any have been reused.

Passwordless authentication: Is this really necessary? We already have a strict policy that enforces strong passwords

The idea that passwords must be of a certain length and complexity dates from an age when hackers would try to brute-force their way into systems by guessing all possible character combinations.

Passwordless authentication: Is this the same thing as the single sign-on fad of a few years ago?

The motivation isn’t dissimilar. Single sign-on (SSO) became popular when big companies realised their standard Windows XP build included 93 applications that each handled their own authentication process. Not only was this a recipe for confusion, it meant there were 93 potential vulnerabilities to worry about. Using a centralised passwordless authentication solution can help, but there’s nothing inherent to a passwordless architecture that actually requires SSO. The goal isn’t to minimise the number of different authentication systems you’re dealing with, but to reduce reliance on the most vulnerable methods.

Passwordless authentication: This sounds like a ploy to get us to invest in biometric sensors

A robust passwordless system should offer a variety of authentication methods – so you can log in with a face scan or a fingerprint while you’re in the office, but when all you have is a patchy mobile signal, you can receive an SMS login code. This can save you money by reducing support calls from users who can’t get into their accounts – and, for what it’s worth, a little fingerprint reader puck ought not to set you back much over £30.

Passwordless authentication: What about customer accounts – should those be passwordless too?

That might not be your decision to make, at least not entirely. If you’re a small business wanting the advantages of shopping baskets, credit card processing and all the rest of the e-commerce experience, your bank will want your customers to fit in with its own policies.

That’s not a huge problem, though. Look after your own customer accounts and let the bank worry about the rest. In time, customer-side shopping interfaces will adopt the latest and safest technology. You can reduce the risk by insisting on unique passwords that change regularly, but users tend to hate that. They’ll be happier, and you’ll be safer, if you switch to an approach that skips the password altogether.

Passwordless authentication: That sounds good in theory, but how would we go about implementing it?

In most cases you don’t implement it yourself – this is the sort of thing that’s best done at the level of the operating system (OS) or service framework. For bespoke application stacks, there are plenty of third-party security providers that can help out, while Windows 10 and Windows 11 already support biometric logins, and Microsoft Azure AD lets you enable users to use the authenticator app to access online services. The Google app suite can similarly bring up a notification on any signed-in Android or iOS device that lets users confirm their identity without typing in a password.

Biometrics aren’t a magic bullet, and, in some ways, they’re worse than passwords. If an attacker gets hold of your fingerprint data or your retinal scan, you can’t conveniently ditch the compromised body part and generate another one. Happily, there’s no need to share your vital statistics with the world. Real purists might stick to app-based approaches, and only use their biometrics to unlock a phone or workstation, which, in turn, generates a one-time login code.

It’s perfectly possible, however, to use biometrics securely online, thanks to a set of standards dubbed Fast Identity Online 2 (FIDO2). One key principle of FIDO2 is that your biometric credentials themselves are never transmitted, rather, they’re used on your device to generate a cryptographic key that securely confirms your identity. What’s more, each website or service requires its own unique key, so it’s mathematically impossible to track individuals across sites.

Clearview AI is providing Ukraine’s defence ministry with free access to its facial recognition technology, the company has confirmed.

The facial recognition software is being used to identify Russian soldiers, tackle misinformation, reunite displaced families, and identify the deceased - as other forms of identification, including fingerprint scanning, become increasingly challenging due to heavy bombardment.

Initially reported by Reuters, the New York-based company has since confirmed to IT Pro that "Clearview AI has provided it's groundbreaking facial recognition technology to Ukrainian officials for their use during the crisis they are facing".

It comes after CEO and co-founder Hoan Ton-That sent a letter to the Ukrainian government offering support following the Russian invasion on 24 February.

In the document, seen by IT Pro, Ton-That claims that Clearview AI has access to over 2 billion images obtained through the Russian social media service VKontakte that can be used to identify Russian soldiers. VKontakte is the most popular social network in Russia, with an estimated 400 million registered users.

Clearview AI, which was founded in 2017, has an overall image database of more than 10 billion photos. In 2021, it was found to have violated GDPR, as well as Australia’s privacy laws, and has been hit with cease and desist notices from the likes of Facebook and Twitter for scraping public images for its systems.

The startup was also found to have broken "several" data protection laws in the UK, with the ICO issuing Clearview AI with a provisional fine of £17 million.

A number of tech giants had reached out to assist Ukraine’s military amidst the Russian invasion, offering support ranging from financial aid to cyber security defences. Businesses including Apple, Cisco, SAP, Microsoft, AMD, Intel, and TSMC also made the decision to pull their operations out of Russia, yet some were criticised for their slow response.

Amazon Web Services (AWS) was the subject of protests during Barcelona’s MWC, before it announced on 9 March that it would no longer accept new subscriptions from Russia and its ally Belarus.

Amazon also stated that it’s working with NGOs and employees to offer immediate humanitarian assistance to Ukrainian citizens, having donated $5 million to organisations providing critical aid on the ground, including UNICEF, UNHCR, World Food Program, Red Cross, Polska Akcja Humanitarna, and Save the Children.

LAPSUS$, the hacking group responsible for the recent Nvidia hack, claim to have breached tech giant Samsung to steal almost 200GB of sensitive data.

Among the 190GB trove of exposed files is source code for Samsung’s activation servers, bootloaders and biometric unlock algorithms for all recently released Samsung devices, and trusted applets for Samsung’s TrustZone environment. Confidential source code belonging to Qualcomm is also believed to be among the leaked data

Members of the LAPSUS$ hacking group have claimed responsibility for the data breach, posting details of the obtained data in a Telegram channel and telling other members to “enjoy” the contents which have been made available to download over Torrent.

According to the message, the hackers also managed to obtain “various other data”, yet the elements listed could place Samsung device users in immediate threat of being hacked or impersonated by cyber criminals.

For instance, the trusted applets (TA) source codes obtained by LAPSUS$ are installed in Samsung’s Trusted Execution Environment (TEE) known as TrustZone, meaning that the hackers – and everyone who has downloaded the Torrent files – could be able to bypass Samsung’s hardware cryptography, binary encryption, as well as access control.

The total size of the leaked data comes to about 190GB, which LAPSUS$ split into three compressed files, and more than 400 peers have already downloaded and shared the torrent.

A Samsung spokesperson said that it has taken steps to bolster its security system "immediately after discovering the incident".

"According to our initial analysis, the breach involves some source code relating to the operation of Galaxy devices, but does not include the personal information of our consumers or employees. Currently, we do not anticipate any impact to our business or customers. We have implemented measures to prevent further such incidents and will continue to serve our customers without disruption," they told IT Pro.

Qualcomm wasn't immediately available for comment, and it remains unclear whether the hacking group had any demands for Samsung before it leaked the confidential data.

News of the hack comes just weeks after researchers found “severe” security flaws in a long line of Samsung's flagship smartphones that, if exploited, would enable attackers to lift cryptographic keys.

It also comes five days after Nvidia confirmed that the LAPSUS$ hacking group had successfully breached its systems on 26 February and distributed 1TB of confidential company data, including security credentials belonging to 71,000 past and present Nvidia employees.

The hacking collective managed to obtain the data using a double extortion method of operation that involves compromising a victim and stealing data before encrypting their machine, as well as threatening to leak the stolen data if the ransom isn’t paid. Double extortion cases have been on the rise in the past year, with one in seven cases resulting in critical data being leaked.

Although LAPSUS$’ attacks come amid the escalating cyber warfare caused by the Russian invasion of Ukraine, the hacking group has maintained that it’s “not state sponsored” and that its actions aren’t politically motivated.

Carbonite and Webroot principal solutions analyst Matt Aldridge said that, similarly to "most modern cyber attacks, these gangs continue to be more inventive with the types of data and businesses they target".

"Considering the victim is a high-profile business, the hackers may have posted a message releasing Samsung’s data with a snapshot of its source code so that they can gain additional leverage for a potential ransom demand. However, since the data breach has already occurred and the data has been exfiltrated, no amount of ransom payment can guarantee that all copies of the data will be securely destroyed," he added.

Aldi has opened its first checkout-free store in London’s Greenwich, months after trialling a till-less supermarket in the Netherlands.

The Shop&Go store, which officially opened at 7am this morning on Greenwich High Street, allows customers to enter the store, pick up their items, and simply walk out with the receipt being issued on the Aldi Shop&Go app.

The store is currently in public trial mode, after being tested by employees “for months”, making Aldi the third UK retailer to trial the technology after Morrisons and Tesco.

Much like its competitors' efforts, Aldi's Shop&Go is powered by cameras supplied by US-based automated retail technology provider AiFi. It also employed as facial age estimation technology provided by London-based biometrics company Yoti, which will be used when shoppers purchase age-restricted products such as alcohol. Customers - who have the option to opt-out and instead have purchases verified by a store employee - will be able to confirm their identity using the Aldi Shop&Go app.

Aldi UK and Ireland CEO Giles Hurley said that he is “looking forward to seeing how customers react to our trial”.

“This store utilises the very latest in retail technology offering Aldi’s award-winning products and unbeatable prices to customers in a new and innovative way. The team are really excited about seeing customers come in and experience Aldi Shop&Go, “ he added.

Commenting on the launch of Aldi’s first checkout-free store, Samuel Mueller, CEO at augmented reality (AR) solutions provider Scandit said that today’s opening “comes as no surprise”.

“This move was to be expected by UK retailers after being squeezed by online giants like Amazon for over a decade,” he told IT Pro. The American online retail giant opened its first UK checkout-free store in March 2021 in London's Ealing, followed by stores in Islington and Dalston.

“We’re seeing many retailers turning to smart data capture and computer vision powered apps on consumer smartphones that offer a frictionless blend of digital and physical shopping. Consumers want the convenience and choice of self-scanning plus the ability to view real-time product information on their device before buying,” he added.

In October 2021, Tesco announced the opening of its first checkout-free store in London’s Holborn, following a successful two-year trial in Welwyn Garden City.

Welcome to IT Pro's News in Review, a weekly bite-sized bulletin of the top tech stories of the week, for the week ending 5 November, 2021.

This week:

• Mesh for Teams is Microsoft's pitch for the metaverse
• Celebrity data leaked after ransomware attack on London's Graff jewellers
• Facebook is shutting down its controversial facial recognition system

You can find more videos like this in our video library and even more on our YouTube channel. Let us know what you think of this week's video – you can also find us on Facebook, LinkedIn and Twitter.

Facebook has announced that it will shut down its facial recognition programme after more than a decade of use.

The company, which recently rebranded to Meta, also said that it will be deleting all users' facial templates. The move will mark the end of website functionality such as automatic user detection in images and Automatic Alt Text - automatically generated descriptions of images used by visually impaired users that currently identifies people in around 4% of all photos on the site.

An exact date for the company's sunsetting of the technology has not been announced, but Facebook said the programme will end "in the coming weeks".

Acknowledging the situation as a "complex social issue", the social network said it wants to move away from the broad identification approach it previously used with its facial recognition tech and move closer towards focusing on narrower forms of personal identification. Such examples include accessing locked accounts, personal devices, and verifying identity in a financial product.

It added that private, on-device use of the technology may be a more adequate way of deploying it since there will be no communication of biometric data between the device and an external server.

Those who have opted-in for facial recognition on Facebook - more than a third of users - will no longer be automatically identified and their face data will be removed from records. Meta believes this will amount to more than a billion facial templates being deleted.

It's currently unclear if there is any other data associated with the programme that Facebook will be retaining. IT Pro has contacted the company for clarity but it had not responded at the time of publication.

Some corners of the tech industry feel the announcement may be a PR move, perhaps to deflect attention away from the recent stories that have surfaced following former employee Frances Haugen's landmark leak of 10,000 files.

"On one level this is a PR gesture - Facebook has much more invasive information about people than their faces," said Professor Mark Andrejevic, Faculty of Arts, Data Futures Institute at Monash University to IT Pro. "But as a PR move it's still an important one as it highlights the real public concern people have about the development of facial recognition technology."

“The destruction of the faceprints is significant. This is a biometric database that, if breached, would amount to a huge event in terms of the release of biometric data. It's rare that companies whose business is data, destroy such a large and potentially powerful database.

Consulting with outside experts along the way, Facebook will continue to work on facial recognition technology because it believes in its power to be a force for good in areas such as identity verification and prevention of fraud. Though, it said the positives have to be considered against the potential drawbacks.

"The many specific instances where facial recognition can be helpful need to be weighed against growing concerns about the use of this technology as a whole," said Jerome Pesenti, VP of artificial intelligence at Facebook in a blog post. "There are many concerns about the place of facial recognition technology in society, and regulators are still in the process of providing a clear set of rules governing its use. Amid this ongoing uncertainty, we believe that limiting the use of facial recognition to a narrow set of use cases is appropriate.

"This includes services that help people gain access to a locked account, verify their identity in financial products or unlock a personal device," he added. "These are places where facial recognition is both broadly valuable to people and socially acceptable, when deployed with care. While we will continue working on use cases like these, we will ensure people have transparency and control over whether they are automatically recognised."

Some experts believe the decision to delete its facial recognition data is due to regulatory pressure that may be imposed in the future, potentially harming commercial relationships.

"Part of their reasoning to shut down the system could be that they realised the nature and type of consent gained may not meet the existing, or future, standards that regulators may expect for sensitive biometric data," said Peter Galdies, consultant at data protection firm DQM GRC. "This potentially renders all the data as unusable anyway.

"I imagine that commercial users of such data would also be somewhat sceptical of forming a business relationship with Facebook on these matters - considering the previous litigations that Facebook has been involved in with privacy regulators."

It's a sentiment that's echoed by other corners of the industry too. Alan Calder, CEO at GRC International Group told IT Pro: Facebook has only ever been interested in what profits Facebook, so shuttering its facial recognition options for one billion users will not be something that is intended to harm the company, but rather protect it from privacy regulators."

Welcome to IT Pro's News in Review, a weekly bite-sized bulletin of the top tech stories of the week, for the week ending 22 October, 2021.

This week:

• Apple unveils redesigned MacBook Pro with M1 Pro, M1 Max chips
• Facebook to hire 10,000 workers across the EU
• Scottish schools serve up facial recognition for school dinners

You can find more videos like this in our video library and even more on our YouTube channel. Let us know what you think of this week's video – you can also find us on Facebook, LinkedIn and Twitter.

Nine schools in Ayrshire, South West Scotland, have rolled out facial recognition technology to take payments for school lunches.

While North Ayrshire Council has been taking payments for lunches using biometrics already, this has been limited to fingerprint scanners. It argues, however, that using facial recognition is faster and more COVID-secure than previous systems it had in place.

The technology is somewhat different to the controversial “live” facial recognition systems used to identify people in a crowd, and instead matches children’s faces against encrypted faceprint templates that are stored on local servers.

In a statement provided to IT Pro, North Ayrshire Council said the system, which has been brought in to replace existing contracts that are expiring, offset the opportunity to make its food service more efficient and “enhances the pupil experience using innovative technology”.

With regards to data security and privacy, the council said: “In keeping with the ICO UK GDPR guidance, pupils in S4-S6 (aged 14-18) have been allowed to provide their own consent, while pupils in S1-S3 (aged 11-15) require parental consent.”

The council declined, however, to answer questions on how it would handle subject access requests and the ‘right to be forgotten’ as set out under GDPR.

Overall, the introduction of the system seems to have been well received. The council spokesperson said: “We have received an excellent response from pupils, parents and carers, with over 97% of responses being positive and providing consent. Pupils often forget their PINs and unfortunately some have been the victim of PIN fraud, so they are supportive of the planned developments and appreciate the benefits to them.”

According to the Financial Times, however, some parents of older pupils at the schools said they’re unsure whether their children had received enough information to make an informed decision and expressed concern that peer pressure may have played a role in them signing up.

Privacy advocacy group Big Brother Watch, which campaigns against the use of mass surveillance technology, has also hit out against the move. The organisation’s director, Silkie Carlo, said: “It’s normalising biometric identity checks for something that is mundane. You don’t need to normalise airport style [technology] for children getting their lunch.”

David Swanston, CEO of the company that provides the technology, CRB Cunninghams, has spoken out to defend the company’s product, telling the FT: “In a secondary school, you have around about a 25-minute period to serve potentially 1,000 pupils. So we need fast throughput at the point of sale.”

Swanston added: “[This is] the fastest way of recognising someone at the till – it’s faster than card, it’s faster than fingerprint.”

These nine schools in Ayrshire may also prove to be just the tip of the iceberg for this technology, with Swanston claiming a total of 65 school sites have signed up so far to use the technology.

The introduction of a £100 contactless payment limit could place shoppers at risk, UK tech industry experts have warned.

It comes as UK credit and debit card users can, from today, start using contactless for payments up to £100 without the need to enter their PIN code.

The decision to increase the threshold was taken by the Financial Conduct Authority (FCA) in a bid to make shopping more convenient and is more than double the amount of the previous contactless payment limit of £45 introduced in April 2020.

This also means customers can spend up to £300 in three separate transactions before they are asked to enter their PIN.

According to the CTO of digital identity verification software provider Mitek, Steve Ritter, “a drive for convenience means security could be overlooked”.

In comments to IT Pro, he added that contactless cards lack the additional layer of security provided by biometric authentication, which is used when making payments using smartphones. Although banks such as the Royal Bank of Scotland and Natwest had begun trialing fingerprint-enabled payment cards in 2019, only a limited number of consumers have access to the technology today.

Teg Dosanjh, director of Connected Services and Technology at Samsung UK and Ireland, said that the public’s focus on hygiene during the pandemic has fuelled the shift from traditional cards to Samsung’s payment app.

“It’s made us all more conscious about using physical keypads and because the increased security of mobile payment is well recognised, the spend limit on Samsung Pay is so much higher, meaning customers may rarely need to touch a chip and pin again,” he said, adding that Samsung research found that contactless payments using smart devices such as phones or watches helped 85% of surveyed users “feel safe”.

Research conducted by Samsung in August found that almost 60% of the 2,000 UK adults surveyed said that they were still leaning towards physical cards to make payments, with 40% of expressing concern about the increased possibility of card fraud

Brian Higgins, security specialist at Comparitech, shares these concerns, telling IT Pro that he anticipates an increase in mugging as a result of the new £100 threshold.

“Personally, I use a pre-paid contactless payment account rather than anything linked to my personal banking information. I know people like things to be quick and hassle free these days but changes like these highlight how important it’s becoming to take some responsibility for your own assets,” he said.

However, chief product and technology officer at payments-as-a-service provider Modulr, Altay Ural, believes that the risk of fraud is “fairly small”. This is largely because consumers have the option to freeze their card as well as claim customer compensation. Meanwhile, the new threshold provides an opportunity “to promote greater consumer spending across UK stores, especially in busy locations like supermarkets, petrol stations and DIY stores where you can easily spend more than £45 in one go”.

Ural’s opinion is backed by UK Finance research, which found that contactless fraud on payment cards as well as devices accounted for less than 3% of overall card fraud losses in 2020, despite 55% of all card transactions being contactless.

US convenience store chain 7-Eleven has been accused of breaching Australian privacy laws by collecting customers' biometric data without their consent.

The Office of the Australian Information Commissioner (OAIC) found that between 15 June 2020 and 24 August 2021, the Australian arm of 7-Eleven interfered with the privacy of individuals by gathering facial recognition data through a hidden mechanism in its customer feedback form.

The OAIC said that 7-Eleven's policy was in breach of the Privacy Act 1988, adding that the information wasn’t reasonably necessary for the store’s functions and activities. It also failed to take reasonable steps to notify individuals about the fact and circumstances of collection and the purposes of collecting that information.

The company has now been told to cease its data collection and destroy any data still held.

Tablet devices containing facial recognition technology were deployed inside 7-Eleven’s 700 stores nationwide, which allowed customers to complete a voluntary survey about their in-store experience. As of March 2021, 1.6 million survey responses had been completed.

As they completed this survey, the tablet’s built-in camera would take a facial image twice, once when the customer first engaged with the tablet, and then again after they completed the survey.

These facial images were stored on the tablet for around 20 seconds before being uploaded to a secure server hosted in Australia on Microsoft Azure. Once the upload finished, the facial image was deleted from the tablet but retained on the server for seven days.

The facial images were then encrypted, turning them into ‘faceprints’, and assessed, providing inferred information about the customers’ approximate age and gender. The store said it was capturing this data to detect if the same person was leaving multiple responses to the survey within a 20 hour period on the same tablet. If they were, it wanted to exclude their responses from the survey results in case they weren’t genuine.

“I am not satisfied that it was reasonably necessary to collect ‘sensitive’ biometric information...for this function or activity,” said Angelene Falk, OAIC commissioner. “I note the risk of adversity to individuals should this kind of information be misused or compromised, as it cannot be reissued or cancelled like other forms of compromised identification information. The risks associated with collection of such information are not proportional to the function or activity of understanding and improving customers’ in-store experience.”

7-Eleven said it had obtained consent from customers who took part in the survey in the form of a notice at the entrance to its stores and on its website. However, the commissioner rejected this, finding that the store did not inform individuals about the fact and circumstances of collection of facial images and faceprints, as required by the law.

The UK government’s updated surveillance camera code of practice, which includes the use of facial recognition technology by law enforcement, show that it's "impossible to regulate for the dangers created by a technology that is oppressive by design".

That's according to Megan Goulding, lawyer for the UK’s largest civil liberties organisation Liberty.

The guidance on the appropriate use of surveillance camera systems by local authorities and the police was implemented in 2013 and hasn’t been revised since. The newly proposed changes would update the guidance in reference to the UK’s Data Protection Act 2018 as well as last year’s Bridges v South Wales Police ruling, which deemed facial recognition technology for law enforcement purposes as unlawful.

Despite the ruling, the newly proposed amendment takes into account the use of the technology, stating that “any use of facial recognition or other biometric characteristic recognition systems needs to be clearly justified and proportionate in meeting the stated purpose, and be suitably validated”.

The government is open to consultation regarding the amendment, which would be the first since the guidance was introduced in 2013, until 8 September 2021.

Goulding, who was involved in advising the appellant in the Bridges v South Wales Police court case, said that “one year since our case led the court to agree that this technology violates our rights and threatens our liberty”.

“These guidelines fail to properly account for either the Court's findings or the dangers created by this dystopian surveillance tool,” she told IT Pro.

According to Goulding, the use of facial recognition will “turn public spaces into open-air prisons, and entrench patterns of discrimination that already oppress entire communities”, adding that, in order to create safer communities, the government “needs to listen to the people who experience discriminatory over-policing”, explore “solutions that rebuild trust”, as well as “stop relying on coercion, control, and punishment”.

"The changes to this surveillance guidance show that it is impossible to regulate for the dangers created by a technology that is oppressive by design. The safest, and only, thing to do with facial recognition is to ban it,” she told IT Pro. “Whatever our background or beliefs, we all want to feel safe and be able to go about our lives freely. Facial recognition undermines these ideals.”

Three senators have written to Amazon with questions about the company's Amazon One palm scanning technology.

The bipartisan group expressed concerns about the biometric system's effect on privacy and its potential to bolster Amazon's market position. The letter, from senators Amy Klobuchar (D-Minn.), Bill Cassidy (R-La.) and Jon Ossoff (D-Ga.) to Amazon CEO Andy Jassy, queries the company's handling of biometric data gathered using the service.

"Amazon’s expansion of biometric data collection through Amazon One raises serious questions about Amazon’s plans for this data and its respect for user privacy, including about how Amazon may use the data for advertising and tracking purposes," the letter said.

Unveiled in September 2020, Amazon One is a contactless payment system that uses palm scanning for applications, including making payments, granting access to locations, presenting loyalty cards, or clocking into work.

The company began rolling it out at its automated Amazon Go stores, which already used technologies like computer vision to replace traditional checkout operators. It has since arrived at some Whole Foods locations, which Amazon acquired in 2017.

Amazon said the service would be an optional entry method at its stores, which would still allow customers to enter using the Amazon app. At launch, the e-commerce giant also vowed to offer customers the devices, including retailers, stadiums, and office buildings.

"Our concerns about user privacy are heightened by evidence that Amazon shared voice data with third-party contractors and allegations that Amazon has violated biometric privacy laws," said the letter, referring to reports the company violated facial recognition privacy law in Illinois by using residents' faces to train its algorithms.

It also cited a class-action lawsuit filed this month against Amazon for allegedly violating the Illinois Biometric Information Privacy Act (BIPA) with its Alexa system.

"We are also concerned that Amazon may use data from Amazon One, including data from third-party customers that may purchase and use Amazon One devices, to further cement its competitive power and suppress competition across various markets," the senators said.

Amazon recently offered consumers a $10 credit to enroll themselves on Amazon One. To do so, customers must present their credit cards and scan their palms with the Amazon One device.

Rather than storing scans locally, the devices send them back to Amazon's cloud. This was an area of concern for the senators, who compared it with biometric scanning technology from Apple and Samsung, which store information locally on the device.

The letter asked Amazon several questions, including when the company plans to expand its use of Amazon One; how many third-party customers has it sold its technology to; how many users have signed up for the service; and whether the company pairs the scans with data from biometric systems.

The senators also asked the company to describe how it uses data from the service, with a special focus on whether it uses the data to personalize advertisements or product recommendations.

A federal judge has forced a Capitol rioter to unlock his Microsoft Surface Pro laptop using facial recognition after prosecutors argued it may contain footage of the 6 January insurrection from his helmet-worn camera.

The Justice Department asked to put Capitol rioter Guy Reffitt in front of the device to unlock its biometric security, which judge Dabney Friedrich granted, according to CNN.

Prosecutors believed Reffitt's laptop could contain over 6GB of videos that the defendant filmed while on the grounds of the US Capitol.

Reffitt has been in jail since he was arrested in January. He pleaded not guilty to five federal crimes, including taking a handgun to the Capitol grounds during the insurrection. Previously, Refitt’s attorneys had said that the search warrant for the laptop had expired and that the defendant was unable to remember if there was a password.

The ruling notably diverges from decisions in similar cases involving law enforcement agencies seeking access to locked devices.

In 2019, a California judge ruled that US police departments are unable to force people to unlock their mobile phones using a face or finger, according to Forbes. Judges had ruled before that police were allowed to unlock devices using biometrics, even though they weren’t permitted to force a suspect to share their passcode.

In what's considered an important part of that case, Judge Westmore said that the government did not have the right, even with a warrant, to force suspects to incriminate themselves by unlocking their devices biometrically.

“If a person cannot be compelled to provide a passcode because it is a testimonial communication, a person cannot be compelled to provide one’s finger, thumb, iris, face, or other biometric feature to unlock that same device," said Westmore.

In 2017, a court in Chicago denied the FBI a warrant to force a building’s occupants to open their Apple devices using their fingerprints. If the request had been granted, it would have allowed federal agents to force people on the premises to unlock their Apple devices using their fingers or thumbs.

The judge argued in that case that the language used in reference to forcing fingerprint unlocking wasn’t specific enough.

European privacy watchdogs have called for a ban on the use of facial recognition in public spaces, pointing to the "extremely high" risks to privacy.

The joint recommendation, which comes from the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS), also urged the bloc to prohibit the use of artificial intelligence (AI) to “infer emotions” or for “any type of social scoring”.

The recommendation comes in response to proposals from the European Commission (EC) on the harmonisation of artificial intelligence rules, which places restrictions on the use of live facial recognition in public places by law enforcement, but does not outright ban it.

The EDPB and EDPS claim the bill doesn't go far enough and are calling for a general ban on any use of AI for automated recognition of human features in publicly accessible spaces, "such as recognition of faces, gait, fingerprints, DNA, voice, keystrokes and other biometric or behavioural signals, in any context."

The watchdogs, which are responsible for ensuring EU institutions stick to the EU's data protection rules, also claim it should be illegal for AI systems to use biometrics to categorise people "into clusters based on ethnicity, gender, political or sexual orientation," or other types of classification under which they could be discriminated against.

Such practices "interfere with fundamental rights and freedoms to such an extent that they may call into question the essence of these rights and freedoms," the heads of the EDPB and EDPS said in a statement.

“Deploying remote biometric identification in publicly accessible spaces means the end of anonymity in those places," they continued.

"This calls for an immediate application of the precautionary approach. A general ban on the use of facial recognition in publicly accessible areas is the necessary starting point if we want to preserve our freedoms and create a human-centric legal framework for AI. The proposed regulation should also prohibit any type of use of AI for social scoring, as it is against the EU fundamental values and can lead to discrimination.”

While many have welcomed the EC's AI regulations as a step in the right direction that sets Europe on a different path to the US and China, privacy campaigners, such as the European Digital Rights (EDRi) advocacy network, have also warned that the rules leave the door open for discriminatory surveillance.

"Today's opinion is clear proof, from the EU's top data protection regulators, that facial recognition in publicly accessible spaces is a grave and disproportionate intrusion into people's rights and freedoms," EDRi policy adviser Ella Jakubowska said.

Information Commissioner Elizabeth Denham has described the use of live facial recognition (LFR) technology in public spaces as 'deeply concerning', and has called on companies not to deploy the technology just to 'save money'.

The statement comes after the Information Commissioner's Office (ICO) conducted six investigations into “planned or actual use of LFR in public places” for reasons ranging from public safety concerns to personalised advertising.

The regulator found that organisations planning to or already deploying the technology tended to be “immature” in their data protection “compliance considerations”.

“Our investigations found that controllers often gave insufficient consideration to the necessity, proportionality, and fairness of the use of LFR systems and failed to be sufficiently transparent,” Denham stated in an Information Commissioner’s Opinion notice.

This has caused Denham to become “deeply concerned about the potential for live facial recognition (LFR) technology to be used inappropriately, excessively or even recklessly”.

“When sensitive personal data is collected on a mass scale without people’s knowledge, choice or control, the impacts could be significant. We should be able to take our children to a leisure complex, visit a shopping centre or tour a city to see the sights without having our biometric data collected and analysed with every step we take,” she added.

The newly-published Information Commissioner's Opinion includes guidance for organisations considering implementing LFR into their practices, asking controllers to “not use LFR simply because it is available, it improves efficiency or saves money, or is part of a particular business model or proffered service”.

However, Denham did note that the technology “may” have some “benefits”.

“LFR has the potential to do significant good – helping in an emergency search for a missing child, for example,” she said.

Therefore, organisations should work on “building public trust and confidence” in the way the data is used, so that “the benefits derived from the technology can be fully realised”.

“Without trust, the benefits the technology may offer are lost,” Denham stated.

While the Opinion published today is mostly targeted towards private companies, it builds on the ICO’s 2019 Opinion into the use of LFR by police forces.

Ten months after the report was published, the use of facial recognition technology for law enforcement purposes was deemed unlawful, with the Court of Appeal declaring that the technology violates human rights, data protection laws, and equality laws.

The use of live facial recognition in public spaces also hit the headlines in 2019 when private developer Argent was found to have used the technology at its 67-acre Kings Cross Central Development site.

London Mayor Sadiq Khan questioned the need for the technology at the time, adding that public spaces "should be open for all to enjoy and use confidently and independently, avoiding separation or segregation".

For the past decade, we’ve been assured that biometric security is the future, and that soon we’ll be able to do away with traditional forms of identification and authentication in favour of using our faces, fingerprints and even voices.

However, while biometric technology is certainly more common than it was in 2010, the promised revolution hasn’t quite materialised. We still have to rely on PINs and passwords for many of our transactions (both financial and otherwise) and biometric authentication is still largely limited to mobile devices. So what’s next for the technology? In this episode, we talk to Steven Furnell, senior IEEE member and professor of cyber security at the University of Nottingham, about where biometric security is going.

Footnotes

• What are biometrics?
• Only skin deep: The state of biometric security
• Petition urges EU regulators to ban biometric mass surveillance
• Hacked for life: Why you should be terrified by biometric technology
• TikTok settles for $92m after being accused of harvesting biometric data
• Dreaming of a world without passwords
• GitHub now supports security keys in a move away from passwords
• Google’s about to push everyone into two-factor authentication
• The IT Pro Podcast: How hackers steal your password
• If not passwords then what?
• The pros and cons of facial recognition technology
• How can facial recognition be made safer?
• Facial recognition tech used by UK police "breaches privacy"
• The IT Pro Podcast: The psychology of security

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

The European Commission (EC) has proposed a new set of wide-reaching regulations that aim to combat the misuse of artificial intelligence (AI).

Under the draft regulations, EU citizens will be protected from the use of AI for mass surveillance by law enforcement, which was ruled unlawful in the UK last year. The use of AI in recruitment, credit score evaluation, as well as border control management will be also be classified as "high-risk” due to discrimination concerns, while systems that allow ‘social scoring' by governments will be banned.

The 100-page document, long-awaited by digital rights campaigners, aims to deliver “harmonised rules” on AI across the EU’s 27 member states and proposes “laying down effective, proportionate and dissuasive penalties for their infringement”. Similarly to the fines imposed by GDPR reaches, companies that break the rules face fines up to 6% of their global turnover or €30 million, whichever is the higher figure.

Commenting on the newly-drafted rules, the EC's executive vice president for the digital age Margrethe Vestager said that, regarding AI, “trust is a must, not a nice to have”.

“With these landmark rules, the EU is spearheading the development of new global norms to make sure AI can be trusted. By setting the standards, we can pave the way to ethical technology worldwide and ensure that the EU remains competitive along the way. Future-proof and innovation-friendly, our rules will intervene where strictly needed: when the safety and fundamental rights of EU citizens are at stake,” she added.

BCS, The Chartered Institute for IT stated that, by directly prohibiting the use of AI for indiscriminate surveillance and social scoring, the new AI legislation sets Europe on a different path to the US and China. BCS director of Policy, Dr Bill Mitchell OBE, said that “there will be a huge amount of work to do to professionalise large sections of the economy ready for this sweeping legislation”.

“These ambitious plans to make AI work for the good of society will be impossible to deliver without a fully professionalised AI industry. Those with responsibility for adopting and managing AI will need to ensure their systems comply with these new regulations, as well as those designing and developing these systems,” he added.

Mitchell also predicts that “those involved in AI” will need to provide “evidence they have behaved ethically, competently and transparently”.

“In principle this is something we should all welcome, and it will help restore public trust in AI systems that are used to make high stakes decisions about people,” he added.

The EC will now have to thrash out the details of the proposed regulations with EU national governments and the European Parliament before the rules can come into force, a process that can take a number of years.

TikTok owner ByteDance has proposed a $92 million (roughly £65.7 million) settlement to a class-action lawsuit after the social media platform was accused of collecting the biometric data of its users.

The lawsuit accused the social media platform of deploying a complex artificial intelligence (AI) system to scan for facial features in users’ videos, alongside algorithms to identify a user’s age, gender and ethnicity.

The accusers claim that TikTok’s app extracted a broad array of such data without consent, while information such as personal and private viewing histories was shared with third-parties such as Facebook and Google.

Also of concern is the potential for this data to be shared with companies based in China, given the lawsuit claimed TikTok doesn’t adequately disclose how user data is shared with entities outside the US.

The settlement, if accepted by a judge, would require TikTok to establish a compensation scheme for its users in addition to launching a ‘privacy compliance’ training programme.

“This settlement is important for many reasons,” said co-lead counsel Katrina Carroll, arguing on the side of the class-action lawsuit.

“First, it provides compensation for TikTok users, but equally as important, it ensures TikTok will respect its users’ privacy going forward. Social media seems so innocuous, but troubling data collection, storage, and disclosure can happen behind the scenes. This settlement sets out to prevent that.”

Co-lead counsel Beth Fegan argued that biometric information is mong the most sensitive of private information because it’s unique and permanent. Therefore, she added, it’s critical that Tiktok users’ privacy is protected against “underhanded attempts at theft.”

TikTok denied any privacy violations following the accusations and has maintained that there was no wrongdoing on its part.

“While we disagree with the assertions,” a spokesperson told the Wall Street Journal (WSJ), “rather than go through lengthy litigation, we’d like to focus our efforts on building a safe and joyful experience for the TikTok community.”

The firm had previously been under fire for a now-rectified vulnerability in its platform that exposed data belonging to its users. According to Check Point Research, if left unpatched, the vulnerability would’ve enabled hackers to access a user’s phone number, nickname, profile and avatar pictures, unique user IDs, as well as certain profile settings.

Artificial intelligence (AI) should be treated with the same scrutiny as medication and warn users about potential “undesirable side effects”, according to an AI ethics expert.

Maria Luciana Axente, PwC UK’s Responsible AI and AI for Good lead, made the statement during a discussion on the second day of the newly-launched AI Festival, adding that data scientists should respond to an ethical code just like medical practitioners.

When quizzed by BT's head of AI and Data Science Research, Detlef Nauck, about whether she thinks AI systems should be regulated like medicines that come “with a description of undesirable side effects”, Axente replied: “Of course, no doubt about it.”

"We have to move in that direction,” she said. “Because we started using AI in so many different domains of life that have a significant impact on people's lives.”

However, Axente added that, although she has heard arguments for creating an agency that would regulate the use of AI in a similar way to how the US Food and Drug Administration aims to protect public health, she believes that it might be worth focusing on existing institutions.

“Let's see what we can be doing on this part of the pond, and how can we leverage some of the institutions we already have, rather than creating new ones – but they will have to go in that direction, especially for high-risk application [of AI],” she said.

She referenced the European Commission’s plans to revise EU laws on the use of AI, with new regulations “set to come in April”.

“I think [they] will allow us to at least separate the use cases that need more attention and more governance from the ones that we can be a little bit more relaxed,” she said.

Axente’s comments come as Facebook’s head of hardware confirmed that the tech giant is considering using facial recognition technology for its upcoming smart glasses, which are set to be released later this year.

Facial recognition has been the subject of a petition launched last week by a coalition of privacy advocates, who are pressuring EU regulators to take advantage of its upcoming revision of AI laws and ban the use of biometric mass surveillance tools.

The NHS app could be used as a digital COVID-19 certificate that allows people to use their smartphones to prove they have been vaccinated or recently tested negative for the virus.

The UK government is thought to be considering a revamp of the NHS app, according to The Times, despite recently stating it wasn't interested in so-called 'vaccine passports'.

The move is being considered following reports that UK businesses, restaurants and entertainment venues are looking into sourcing certification services from third-party companies. Most were said to be looking into vaccine certifications for customers, but some are thought to be looking at similar tech for their employees.

Michael Gove is said to be leading a review into a number of options, which include a revamp of the standard NHS app or the Test and Test system to prove vaccination status or confirm the result of a recent test as a way of entering a venue. Whether this also includes uploading a self-administered lateral flow test is currently unclear.

The government's previous stance on the matter was that rapid flow tests would be a better method of ensuring people could visit venues safely. The secretary in charge of the COVID vaccine rollout was asked about businesses adopting digital certification following reports that the Cineworld chain of movie theatres was looking into it. However, Cineworld told IT Pro that it is "emphatically not the case", and added that it was "not aware" of any of its members seeing rapid testing as the way forward.

Vaccine passports were first touted as a method for airlines to welcome custom back, but the idea has spread to the high street, where shops, bars and restaurants also want to be able to check who is entering their establishments. For the campaign group, Big Brother Watch, vaccine passports used in this way represents another attack on the public's privacy.

The group have long campaigned against forms of identification, particularly those rolled out by governments. They say their fight is about empowering citizens against overbearing authorities.

"At this moment, the UK should be showing courage and leadership to build a freer future - to 'set the people free'," the group said in a blog post. "Instead, with vaccine IDs and more, the government is offering us a future of more controls, not more freedom."

The European Union (EU) should ban biometric mass surveillance tools such as facial recognition when it lays out its plans to regulate artificial intelligence (AI), a coalition of privacy advocates have claimed.

The coalition, which includes Reclaim Your Face, European Digital Rights (EDRi), Privacy International, and numerous other non-profits, has made its demands official by launching a petition aimed at pressuring the EU to reconsider its stance on surveillance using biometric technology.

The petition warns of numerous potential outcomes of not regulating the technology, such as employers monitoring facial expressions of job candidates in order to decide if they’re fit for the position, or insurance companies increasing premiums based on dress codes.

The coalition listed various examples of uses of biometric mass surveillance in EU member states including France and Serbia, which had violated EU data protection law as well as “unduly restricted people‘s rights including their privacy, right to free speech, right to protest and not to be discriminated against”.

According to EDRi member Linus Neumann, biometrics used in mass surveillance bring “'internet-style' omnipresent tracking to the offline world”, leading to the eradication of “the few remaining refuges of privacy”.

Privacy International campaigns officer Caitlin Bishop told IT Pro that the organisation "is extremely concerned with the increasing uptake of biometric mass surveillance around the world".

"Forms of biometric mass surveillance we've already seen in use, such as live facial recognition at protests, pose serious threats to people's fundamental rights, such as freedom of expression and the right to protest - rights which are the bedrock of democracy," she said.

"Biometric mass surveillance is creeping out of science fiction and in to the real world - we're asking the EU to take a stand and put it back where it belongs."

In order to succeed, the petition needs to be signed by at least one million supporters in at least seven EU member states during the next year. If achieved, the European Commission (EC) will be obliged to respond to the petition by opening a debate among the Members of the European Parliament.

Last year, the EC considered a ban on the use of facial recognition in public spaces in public spaces in order to buy time to assess risks and develop legislation. However, it’s expected to revise its laws on AI, including facial recognition, later this year.

Last August, the UK’s Court of Appeal declared the use of facial recognition technology for law enforcement purposes unlawful because it violates the fundamental right to privacy.

As of the time of publication, the petition has been signed by almost 3,500 people.

The Post Office has announced plans to launch a free-to-use app that will use biometrics to authenticate customers and prevent fraud.

The new app will be based on software supplied by London-based company Yoti, which launched in 2014 and specialises in digital identity technology. It will take advantage of biometric-face matching and liveness detection in order to ensure the privacy of Post Office customers and prevent potential imposters from obtaining sensitive information.

The app could help to ensure social distancing by enabling customers to be identified for passport and driving licence renewals from the safety of their homes, without the need to attend a post office in-person.

Set to launch in the spring, the app will also enable customers to use their digital identity to carry out a range of online and in-person transactions such as one-click bank account applications, job applications, mortgage applications, picking up parcels and for travel purposes.

Along with this will be new in-branch services for customers who do not have access to a smartphone, or who prefer face-to-face contact when asked to confirm their identity.

As part of this partnership with Yoti in July, a pilot, initially at around 750 Post Offices, will offer these new in-branch services. This will enable those people without a smartphone, secure internet access, or photo ID to complete their identity verification at a Post Office. Those who simply prefer face-to-face transactions will also be able to have their identity verified by a Postmaster in-branch.

Post Office chief executive Nick Read said that he is “delighted that Post Office and Yoti are joining forces” in order to expand the former’s identity services.

“We have an ambitious strategy to deliver a unique offer to the market that integrates digital and physical identity verification at scale benefitting both individuals and businesses,” he added.

“Post Office is embracing new technologies and this partnership will enhance our reputation as the trusted go-to destination for identity solutions. Whether it’s proving your identity on a smartphone or face-to-face with a Postmaster, we will make transactions faster and simpler than ever before.”

Yoti CEO Robin Tombs said that the company had “already invested over £85m creating a world-leading ID platform that removes the friction from outdated ID processes, puts individuals in control of their identity, preserves privacy and helps reduce identity fraud”.

“Together with the Post Office, we will help drive the UK’s digital transformation, making life simpler and safer for individuals and businesses online, in-branch and on the high street,” he added.

Commenting on the partnership, Cabinet office minister Julia Lopez said that “products that help digitally to verify a person’s identity are becoming increasingly important as more areas of our work and home lives move online”.

“Creating a common trust framework will give greater clarity and certainty to organisations who want to work in this field about what is expected of them. More importantly, however, it will help to deepen users’ trust and confidence in digital identities and the standards we expect in the safeguarding of their personal data and privacy.”

This article originally appeared in Issue 9 of IT Pro 20/20, available here. To sign up to receive each new issue in your inbox, click here.

Deepfakes, also known as synthetic media, are spreading. Today, deepfake technology is most commonly used to create more realistic fake images or videos, but it can also be used to develop fake biometric identifiers such as voice and fingerprints.

Most of us will have likely watched a film, tv show or advert that uses this technology, and we’ve probably all come across a ‘deepfaked’ photo or video – either knowingly or unknowingly – on social media. Some of us may even have played around with creating our own deepfakes using apps that let you superimpose your face onto that of your favourite actors.

“Until recently you needed the sophisticated technology of a Hollywood studio to create convincing deepfakes. Not anymore. The technology has become so advanced and readily available that one guy in his bedroom can create a very realistic deepfake,” says Andrew Bud, ceo and founder of fintech firm iProov. “A lot of people are using it for entertainment content, plus there’s legitimate firms whose entire business is creating synthetic video and audio content for advertising or marketing purposes.”

The dark side of deepfakes

But deepfake technology also has a dark side. For some time now it’s been used to create photos or videos to spread misinformation and influence public opinion or political discourse, often by attempting to discredit individuals or groups.

“Recent history has shown a proliferation of attacks to manipulate democratic elections and destabilise entire regions,” says Marc Rogers, VP of cybersecurity at technology firm Okta and co-founder of international cyberthreat intelligence group The CTI League. “The implication being a deepfake from a trusted authority could artificially enhance or destroy public confidence in a candidate, leader or perception of a public issue – such as Brexit, global warming, COVID-19 or Black Lives Matter – to influence an outcome beneficial to a malicious state or actor.”

IDC senior research analyst, Jack Vernon, notes: “With the US presidential election drawing closer, this will be an obvious arena in which we may see them deployed.”

Deepfake pornography is another rapidly growing phenomenon, often used as blackmail, while another risk comes from criminals using faked biometric identifiers to carry out fraud.

“One notable example took place last year when attackers used deepfake technology to imitate the voice of a UK ceo in order to carry out financial fraud,” Rogers highlights.

It’s unsurprising, then, that last month the Dawes Centre for Future Crime at UCL published a report citing deepfakes as the most serious artificial intelligence (AI) crime threat. Ranked in order of concern, the technology was rated the most worrying use of AI in terms of its potential applications for crime or terrorism.

Who’s most at risk from deepfake crime?

Bud believes the areas most at risk from deepfake crime include the banking industry, governments, healthcare and media.

“Banking’s definitely at risk – that’s where the opportunity for money laundering is greatest. The government is also at risk: Benefits, pensions, visas and permits can all be defrauded. Access to someone’s medical records could be used against them and social media is at risk of weaponisation. It’s already being used for intimidation, fake news, conspiracy theories, destabilisation and destruction of trust.”

Experts say we can expect things to get worse before they get better, as the quality of deepfakes is only likely to improve. This will make it harder to distinguish which media is real, and the technology may get better at fooling our security systems.

Fighting back

The good news is the technology industry is fighting back, and we’re seeing deepfake detection technology emerge from a number of research fields, says Nick McQuire, senior vice president at Enterprise Research.

“This is an area we’ve long predicted would emerge because firms like Microsoft, Google and Facebook are looking at ways to use neural networks and generative adversarial approaches (GANs) to analyse deepfakes to detect statistical signatures in their models.”

There are many initiatives to identify deepfakes, “for example the FaceForensics++ and Deepfake Detection Challenge (DFDC) dataset,” says Hoi Lam, a member of the Institution of Engineering and Technology’s (IET) Digital Panel.

Then there’s facial recognition cross-referencing, which is increasingly being used by video hosting services. “Various techniques are also being explored that implement digital watermarking,” explains Matt Lewis, research director at NCC Group. “This can help prove the origin and integrity of content creation.”

A number of the big tech firms have begun to promote tools in this area. Microsoft, for example, recently unveiled a new tool to help spot deepfakes and in August Adobe announced it would start tagging Photoshopped images as having been edited in an attempt to fight back against misinformation.

GCHQ also recently acknowledged deepfakes as a cybersecurity priority, launching a research fellowship set to delve into fake news and misinformation and AI. “New technologies present fresh challenges and this fellowship provides us with a great opportunity to work with the many experts in these fields,” a spokesperson said.

Businesses are also starting to understand the risk from deepfakes and implementing new technologies designed to detect fraudulent biometric identifiers. Banks in particular are ahead of the game, with HSBC, Chase,Caixa Bank and Mastercard just some of those who’ve signed up to a new biometric identification system.

We’re in an arms race

As malicious actors innovate to stay a step ahead of security teams, technologists being drawn into an arms race, and the work to identify deepfakes is ongoing.

“As security teams innovate new technology to identify deepfakes, techniques to circumvent this will proliferate and unfortunately serve to make deepfake creation more realistic and harder to detect,” notes Rogers. “There’s a feedback loop with all emerging technologies like these. The more they generate success the more that success is fed back into the technology, rapidly improving it and increasing its availability.”

While the technologists fight the good fight, the other important tool in the war against devious deepfakes is education.

The more aware the public is of the technology the more they’ll be able to critically think about their media consumption and apply caution where needed, says Nick Nigram, a principal at Samsung NEXT Europe. “After all, manipulation of media using technology is nothing new,” he concludes.

From airports to local supermarkets and mobile phone applications, facial recognition technology (FRT) has become increasingly commonplace. This advanced technology, which uses unique facial features to identify and authenticate individuals, is transforming the way we interact with the world around us. Its adoption spans various sectors, enhancing security, streamlining processes, and providing unprecedented convenience in everyday activities. 

However, the rise of facial recognition technology is not without controversy, as it brings with it a host of ethical, privacy, and security concerns that fuel ongoing debates.

On one hand, facial recognition technology can make life easier and processes smoother. Many smartphones now offer facial recognition as a quick and secure login option, such as Apple's FaceID on the iPhone. In public spaces and transportation hubs, FRT can speed up security checks, reduce wait times, and improve the overall user experience. Its ability to quickly and accurately verify identities has made it a valuable tool in enhancing safety and efficiency.

However, the widespread use of facial recognition technology has also drawn criticism from various campaign groups and privacy advocates. Organizations such as Liberty and Big Brother Watch in the UK argue that this technology poses significant risks to individual privacy and civil liberties. 

They raise concerns about the potential for mass surveillance, misuse of biometric data, and the possibility of unfair profiling of individuals who have not committed any wrongdoing. The fear is that, without proper regulation and oversight, facial recognition technology could lead to a society where personal freedoms are compromised, and individuals are subject to constant monitoring.

As facial recognition technology continues to advance and integrate into more aspects of daily life, it is essential to weigh its benefits against the potential drawbacks. The ongoing discussion around FRT highlights the need for a balanced approach that maximizes its advantages while addressing the ethical and privacy challenges it presents.

How does facial recognition technology work?

Facial recognition technology uses computer vision technology to extract useful information from still images or videos. This data is then analyzed by an algorithm that estimates the similarity between two faces. The algorithm considers various facial features, such as expressions and geometry. It examines several data points, including the distance between the eyes, the space between the nose and mouth, the shape of the cheekbones, and the overall length of the face from forehead to chin.

This information is transformed into a unique 'faceprint,' a set of biometric data comparable to a fingerprint. The facial recognition system can then be employed in a wide range of applications. With this understanding, let's explore the pros and cons of facial recognition technology.

Pros of facial recognition technology

Improving security systems and identifying criminals are often cited when arguing in favor of facial recognition, as well as getting rid of unnecessary labor or human interaction. However, there are also plenty of other examples.

1. Finding missing people and identifying perpetrators

Facial recognition technology is used by law enforcement agencies to find missing people or identify criminals by using camera feeds to compare faces with those on watch lists.

The technology has also been used to locate missing children. Sometimes it is combined with advanced aging software to predict what a child might look like based on photos taken when they disappeared. Law enforcement agencies often use facial recognition with live alerts to help track potential matches. 

2. Protecting businesses against theft

Facial recognition is increasingly being deployed as a means of identifying known individuals before they commit crimes like theft or public affray. It's common to see CCTV in shops and places of work, and by using facial recognition software it's possible to create tools like automatic cross-referencing to match individuals to a database of known suspects.

The technology has the dual purpose of helping to prevent crime before it happens, and also – some would argue – a deterrent for would-be offenders.

If something is stolen from the business, the software can also be used to catalog the thieves for future reference.

3. Better security measures in banks and airports

Facial recognition has also come to be used as a preventative security measure in sensitive locations such as banks and airports. Similar to identifying criminals that come into shops, the software has helped identify criminals and passengers that pose a potential risk to airlines and passengers.

Border checks have also been sped up at some airports through the use of facial recognition cameras at passport-check gates.

Institutions like banks use the software in the same way to prevent fraud, identifying those previously charged with crimes and alerting the bank to watch specific individuals more carefully.

5. Drastically reduces human touchpoints

Facial recognition requires fewer human resources than other types of security measures, such as fingerprinting. It also doesn’t require physical contact or direct human interaction. Instead, it uses artificial intelligence (AI) to make it an automatic and seamless process.

It also limits touchpoints when unlocking doors and smartphones, getting cash from the ATM or performing any other task that generally requires a PIN, password or key.

5. Better tools for organising photos

Facial recognition can also be used to tag photos in your cloud storage through iCloud or Google Photos. Users who wish can enable facial recognition in their respective photo app’s settings, resulting in named folders for regular photo subjects. Facebook also used facial recognition to suggest people to tag within a photo.

6. Better medical treatment

One surprising use of facial recognition technology is the detection of genetic disorders.

By examining subtle facial traits, facial recognition software can, in some cases, determine how specific genetic mutations caused a particular syndrome. The technology may be faster and less expensive than traditional genetic testing.

7. Enhancing retail customer experiences

Facial recognition technology can also be used to personalize customer experiences in retail settings. By recognising returning customers, stores can offer personalized greetings, tailor product recommendations, and provide a more customized shopping experience. 

This can enhance customer satisfaction and loyalty, as shoppers feel recognised and valued by the business. Additionally, it can streamline the checkout process by allowing for facial recognition payments, reducing wait times and improving overall service efficiency.

Cons of facial recognition

As with any technology, there are drawbacks to using facial recognition, such as the violation of rights and personal freedoms that it presents, potential data theft and the risk of overreliance on inaccurate systems.

1. Greater threat to individual and societal privacy

The threat of technology intruding on an individual's rights to privacy is perhaps the greatest threat created by extensive use of facial recognition.

Privacy is now a critical issue, so much so that in some cities across the likes of California and Massachusetts, law enforcement agencies are banned from using real-time facial recognition tools. Police instead are forced to rely on recorded video from tools like body worn cameras.

In 2021, then UK Information Commissioner Elizabeth Denham described the use of live facial recognition (LFR) cameras in public spaces as "deeply concerning".

2. Infringement on personal freedoms

It's just not personal privacy that is potentially at risk with mass use of facial recognition – the simple act of being recorded or scanned by the technology could discourage individuals from moving freely around their local neighborhood or city.

The argument here is that people simply do not want to feel like they are overtly being watched, judged, or recorded. 

The basic premise of facial recognition is to match everyone to a database of known suspects, essentially treating you as if you are a criminal suspect without probable cause. It's a concept that some people find inherently dangerous to public freedoms.

For example, the aforementioned example of facial recognition being used to catalog potential shoplifters has led to problems for companies such as Southern Co-operative, which in 2022 faced a legal complaint for its widespread use of FRT CCTV in its shops.

3. Violation of personal rights

When used for identification purposes, facial recognition data is considered as part of the ‘special category’ of personal data under the UK's implementation of the GDPR. This also extends to racial or ethnic origin, and some facial recognition CCTV companies have been accused of.

In July 2022, a cross-party group of 67 MPs called for surveillance equipment from Chinese firms Hikvision and Dahua to be banned from use in the UK, citing concerns over ethics and security. These were informed by stories such as a report by the LA Times alleging that Dahua developed software to allow its cameras to detect Uighur minorities and issue law enforcement users with a warning upon successful detection.

4. Creates data vulnerabilities

Facial recognition also creates a data protection and cybersecurity headache. The large volume of personally identifiable information (PII) being collected and stored is an attractive target for cyber criminals, and there are already examples of hackers gaining access to such systems.

This data is particularly sensitive given that many online services, such as banking, are increasingly utilising biometric data as part of their multi-factor authentication. A threat actor with access to a database of facial data could have the tools to bypass such checks, and access even more sensitive information.

5. Provides opportunities for fraud and other crimes

Lawbreakers can use facial recognition technology to perpetrate crimes against innocent victims too. They can collect individuals’ personal information, including imagery and video collected from facial scans and stored in databases, to commit identity fraud.

With this information, a thief could take out credit cards and other debt or open bank accounts in a victim’s name. In consideration of the aforementioned use of facial recognition to place shoplifters on criminal databases, threat actors could even place individuals on a criminal record.

Beyond fraud, bad actors can harass or stalk victims using facial recognition technology.

For example, stalkers could perform reverse image searches on a picture taken in a public place to gather information about their victims, to better persecute them.

Facial recognition law has lagged behind potential use by bad actors in recent years, which has prompted calls from rights groups for stricter biometrics regulations, to extend to technologies such as live facial recognition.

6. The technology is imperfect

Facial recognition is far from perfect, and cannot be relied upon to produce accurate results in place of human judgement.

The technology depends upon algorithms to make facial matches. Those algorithms are more effective for some groups, such as white men than other groups such as women and people of colour due to lack of representation within the data set on which the algorithm was trained. This creates unintentional biases in the algorithms, which could in turn translate to biases in whatever action the technology is informing, such as arrests.

In 2018, civil liberties organisation Big Brother Watch published evidence that facial recognition technology utilised by the UK's Metropolitan Police Service (MPS) was incorrectly identifying innocent people as criminals 98% of the time.

7. Innocent people could be charged

Following on from the imperfection of facial recognition, there are inherent dangers in false positives. Facial recognition software could improperly identify someone as a criminal, resulting in an arrest, or otherwise cause them reputational damage if they were to be included on, for example, a list of shoplifters.

8. Technology can be fooled

Other factors can affect the technology’s ability to recognize people’s faces, including camera angles, lighting levels and image or video quality. Mild alterations of facial data, such as a false mustache, can trick weaker facial recognition systems, while especially poor facial recognition technology could simply be tricked with a photo of a face it recognizes.

As facial recognition technology improves, its flaws and the risks associated with it could be reduced. Other technology is also likely to be used in tandem with facial recognition technology to improve overall accuracy, such as gait-recognition software.

For the time being, though, the technology’s inadequacies and people’s reliance on it means facial recognition still has much room to grow and improve.

9. Lack of transparency and accountability

One significant concern with facial recognition technology is the lack of transparency and accountability in its deployment and use. Often, the specifics of how the technology is implemented, how data is collected and stored, and who has access to the data are not disclosed to the public. 

This opacity can lead to abuses of power, as there are few mechanisms in place to ensure that the technology is used responsibly and ethically. Without clear guidelines and oversight, there is a risk that facial recognition could be used for unauthorized surveillance or to target specific groups of people unfairly. The lack of transparency makes it difficult for individuals to know when and where they are being monitored, eroding trust in institutions that use this technology.

Examples of facial recognition software and apps

Although you might not know it, there’s plenty of examples of facial recognition software available on the market today. This ranges from options provided by tech giants, to software created and fine tuned by smaller companies. Here’s a selection of a few that are available on the market today, some with free options available too.

Amazon Rekognition

Amazon Rekognition is the tech giant’s computer vision APIs that you can add to your apps without needing to spend time building machine learning models. It claims to be able to analyze millions of images or videos in seconds. Some of the features include face compare and search, text detection, and video segment detection.

It has a free tier which lasts for 12 months, where you can analyze 5,000 images per month and store 1,000 face metadata objects per month for free. Its paid tier varies depending on how many images you plan to analyze per month.

FaceFirst

FaceFirst is a facial recognition platform designed for retail, law enforcement, and transportation industries. It offers features like real-time facial recognition, watchlist alerts, and demographic analysis. 

FaceFirst aims to enhance security and customer experiences by providing accurate and fast identification. The pricing for FaceFirst is typically customized based on the scale and requirements of the deployment.

Face++

Face++ is a facial recognition software developed by the Chinese company Megvii. It offers robust facial detection, recognition, and analysis capabilities. Features include face comparison, face search, face grouping, and facial feature analysis. 

Face++ is widely used in various applications, including mobile apps, banking, and security systems. The pricing varies based on the number of API calls and the specific features used.

Kairos

This company provides another API that developers and businesses can use to easily integrate into their software or applications. Its features include gender detection, age detection, multi-face detection, and face verification.

Pricing starts at $19 per month for the Student Cloud, while developers will pay $99 and businesses $249 per month. Each tier supports a different amount of transactions per minute, and these are priced at $0.002 per transaction.

Microsoft Azure AI Face

This allows you to embed facial recognition technology into any apps you create. The good news is that you don’t need any machine learning knowledge, you just plug in the API and you’re good to go. It contains face detection and can identify a person by matching the face to a private database or through photo ID.

It has a free tier, with 30,000 transactions free per month, or the standard tier which starts at $1 (£0.81) per 1,000 transactions up to a maximum of 1 million transactions per month.

The UK's Information Commissioner's Office (ICO) and its Australian counterpart are launching a joint investigation into the data practices of facial recognition firm Clearview AI.

The Office of the Australian Information Commissioner (OAIC) and the ICO has said the investigation will focus on the company's use of "scraped" data and biometrics.

Clearview AI is a US-based facial recognition company used by law enforcement agencies. Its clientele reportedly includes the FBI and Homeland security, as well as some 6,000 other police organisation around the world. Its facial recognition app lets users upload the photo of a suspect and it matches it to images collected from the internet. The system then links to where the photo appeared.

The firm first came to the attention of privacy campaigners after a report in The Seattle Times revealed it had used images from social media sites in its facial recognition systems without the consent of users. Following the article, Twitter and Facebook both released cease and desist notices to Clearview AI and a number of privacy groups threatened legal action.

The ICO told IT Pro that following the signing of a Memorandum of Understanding earlier this year, it has agreed to work alongside the Australian data regulator in a single investigation, given that Clearview AI's data processing activities occurred across both jurisdictions.

The regulator added that its own investigation highlighted the importance of "enforcement cooperation" when protecting the personal information of Australian and UK citizens in a "globalised data environment". It has refused to comment further while investigations are ongoing.

It has been reported that Clearview AI has a database of more than three billion images, which the company claims to have "scraped" from various social media platforms.

While a number of tech firms, including IBM and Amazon, announced plans to ditch or halt facial recognition systems in light of the Black Lives Matter protests, Clearview AI has only pledged to stop private firms from using them. Its services are still available to law enforcement agencies at the time of writing.

A growing number of Google employees have signed a letter to parent company Alphabet demanding that it ceases all technology sales to US police departments, following weeks of protests against racially-motivated police brutality.

According to TechCrunch, the letter to Alphabet CEO Sundar Pichai has been signed by at least 1,666 employees.

Google has openly discussed how its G Suite is used by the Clarkstown Police Department in the state of New York in order to “share information and digital evidence”. The tech giant is also known to fund police departments through private donations as well as invest in startups developing artificial intelligence (AI) technology for the police and military.

In the internal letter, seen by TechCrunch, Google employees wrote that they are “disappointed to know that Google is still selling to police forces, and advertises its connection with police forces as somehow progressive, and seeks more expansive sales rather than severing ties with police and joining the millions who want to defang and defund these institutions.

“Why help the institutions responsible for the knee on George Floyd’s neck to be more effective organizationally? Not only that, but the same Clarkstown police force being advertised by Google as a success story has been sued multiple times for illegal surveillance of Black Lives Matter organizers.”

Google issued a statement announcing that it is reviewing more than 500 product suggestions made by its staff in recent weeks.

“We're committed to work that makes a meaningful difference to combat systemic racism,” a Google spokesperson told IT Pro over email.

“On this one, we were the first major company to decide, years ago, to not make general purpose facial recognition commercially available and we have very clear AI Principles that prohibit its use or sale for surveillance. We have long standing terms of use for generally available computing platforms like Gmail, G Suite and Google Cloud Platform, and these products will remain available for governments and local authorities, including police departments, to use.”

Earlier this month, Amazon, Microsoft, and IBM announced that they would be pausing or ceasing sales of facial recognition technology to US police departments, a decision which was welcomed by the American Civil Liberties Union.

Proving we are who we say we are has been a significant challenge for decades. The use of passwords remains the at core of identification, but using the unique characteristics of our bodies as an alternative method of authentication is growing in popularity, with fingerprints, voice, retinal scans and face recognition all developing in parallel.

The e-passport, for instance, is the most conspicuous use of biometric technology, having been introduced to UK passports in March 2006. If you have a passport from not just the UK but most other countries, it will likely be an e-passport, with a biometric chip inserted in the final page. Over the intervening 14 years, though, this has been joined by many other security services based on a range of biometric identifiers.

Accessing financial services and making payments have been the focus of many biometric technologies in recent years. As payments have increasingly moved to mobile devices, these have accelerated the development of biometric identification systems.

Research by MasterCard and Oxford University’s Department of Computer Sciences found 93% of respondents prefer biometrics to passwords. This isn't surprising, as consumers can have up to 90 online accounts all of which should have separate passwords, which isn’t practical. Commercially, moving away from passwords is also imperative, as the research revealed a third of transactions were abandoned because of forgotten passwords.

Already banks are embracing biometrics with voice and face authentication systems joining fingerprints as the preferred methods to identify their customers when accessing their accounts and making transactions. The current coronavirus crisis has also accelerated the use of biometrics as businesses have scrambled to put in place robust security for mass numbers of remote workers.

The core driver behind all biometric developments is to preserve the user experience, while also providing highly secure authentication. The current use of multi-factor identification processes, often using security codes sent to mobile phones, is not frictionless and can become a barrier between the consumer and business. HSBC, for instance, has pioneered the use of voice ID for telephone banking customers and claims its system has prevented £400 million of telephone fraud taking place.

Using the physical characteristics of our bodies has been the core focus of biometric identification for the past decade, but these are now also being joined by behavioural tracking to add a layer of authentication.

“We are now starting to see some interesting use cases for biometrics, for example, camera software that can recognise you by your walking gait,” Keiron Shepherd, principal security systems engineer at F5, tells IT Pro.

“In the future, imagine a scenario where gait analysis is carried out as you walk up to a building by the security camera, and then your RFID security pass lets you through the door, but only if the ID on the security pass matches the walking gait.”

It's now possible to assess how fast you type on your phone, or how you usually access online services, including your banking and payment activity. Tracking this behaviour could deliver a new and more accurate set of biometric data.

The question arises, however, as to whether consumers would give their consent for this information to the collected and used to create a detailed profile of their behaviour. An apparent reaction to this is the updating of the privacy guidelines from the Biometric Institute.

And guidelines are all that exist, as no universal, comprehensive and interoperable ID systems have been created with or without a biometric component. So far, businesses and organisations have developed their own bespoke platforms based on their authentication needs. Clearly, as artificial intelligence (AI) – in particular, machine learning – with its ability to offer more accurate pattern recognition than a human operative – is part of the future development of biometrics. However, moving too fast into automated systems is a concern of many who oversee and campaign for our privacy.

Is it really you?

As the mobile phone is now ubiquitous, it has become a focus for biometric security applications. We’re increasingly encouraged to make contactless payment where possible in the wake of COVID-19, and smartphones look likely to become the centre for identification and authentication for many people making everyday transactions. Also, over 20 banks across the world are testing contactless payment cards using the established VISA and MasterCard networks with added biometric security. Ensuring these systems can’t be compromised is a core component of more mass use of biometric security systems.

Since biometric technologies became viable, the ways in which these systems could be beaten or undermined have filled news headlines. The 3D printing of fingerprints or the duplication of faces a la the Mission Impossible films have often been pointed to. While it’s true the issue of false positives has dogged the industry for some time, the biometric systems being deployed today are very difficult to compromise.

It’s not just in-person payments where biometric authentication is becoming more important. With the massive rise in smart speaker ownership – 1-in-5 UK households own one of these devices according to Strategy Analytics – voice has become another focus for biometric security. As more of us shop at home, ordering and paying via voice commands is increasingly popular as it’s frictionless – you can literally order and authenticate yourself in one breath – and is also seeing a big push from banks and retailers.

But there’s a dark cloud on the horizon. The rise of deepfake images and now deepfake synthesised voices is a real and present danger. Last year, an energy company was tricked into making a substantial payment via a phone conversation which was later revealed to be a faked voice of the company’s chief executive. There is still plenty of work to be done to remove this level of potential fraud.

Speaking to IT Pro, Joe Bloemendaal, head of strategy at Mitek, an identity verification provider says: “The rise of deepfake technologies is concerning for biometric security. Bad actors are taking advantage of more sophisticated AI and Big Data to defraud the public. The good news is that the ability to identify deepfakes will only improve with time, as researchers are experimenting with AI to spot even the deepest of fakes using facial recognition and behavioural biometrics.”

A biometric future

What the coronavirus pandemic has thrown into sharp relief are the weaknesses we have in the security systems that protect the most sensitive aspect of our lives. Proving who we are when using digital services is moving through rapid change.

The so-called onboarding process, where a new customer is authenticated, will continue to accelerate the use of digital systems – many of which will have a biometric component. Early adopters in Africa, for instance, have shown how these systems can work. In the West, the biometric market has become fragmented and confusing with many competing systems.

A future saturated in biometric identification, as portrayed in films like Minority Report where retinas can be scanned thousands of times, may not be around the corner, but mass face recognition is in active development. A major issue with these systems is the possible racial bias that can be inherent in these applications.

Research from the National Institute of Standards and Technology that analysed 189 algorithms showed higher inaccuracy rates for African Americans and Asians than with Caucasians. Add to this the possible bias with the AI systems that may be used to analyse these images, the reliability of accurate identification is called into question.

“It’s important to note that not all approaches to implementing biometrics are the same,” explains Andrew Shikiar, executive director of the FIDO Alliance. “The critical differentiator [is] how and where this most sensitive form of data is stored.”

“Breaches such as the one against the Biostar 2 platform last summer have demonstrated the risks associated with mismanagement of user biometrics,” he continues. “While it’s certainly inconvenient and damaging to have one’s password stolen, the impact of a stolen biometric is far worse as they inherently cannot be changed. While every organisation wants to optimise security and convenience, this should never be done at the cost of taking on added liability and risk to one’s brand and reputation.”

There is little doubt that biometrics will play an increasingly important role in security, particularly for making payments and accessing other financial services. Care does need to be taken when building these systems to ensure they are not just robust, but they are also free from bias.

To guide the development and implementation of biometric technologies, the Biometrics Institute has developed its Ethical Principles for Biometrics. This kind of guidance is vital to ensure the technologies in development are applied safely and without discrimination.

Using passwords and passcodes is still mainstream, but the rapid expansion of AI is driving the development of advanced biometric systems. Consumers and businesses alike can see the benefit yet, remain concerned about the collection of yet more data points to further personalise their digital profiles. Convenience is likely to win out, as we move into a post-COVID-19 environment where contactless payments and access to digital service can be achieved with our phones using fingerprint, voice and face biometrics.

The Department for Transport (DfT) has thrown its weight behind a project to bring ‘biometric entry corridors’ powered by facial verification technology to Eurostar services.

From next year, passengers using the Eurostar from London St Pancras will be allowed to board trains using a walk-through system, automating ticket checks and the border exit process.

This implementation will eliminate the need for passengers to come into contact with either human staff, or hardware.

Using iProov’s authentication technology, passengers will be given the option to scan their ID onto the Eurostar app prior to travelling with the platform verifying the user against their document. When arriving at St Pancras, the passenger would then enter a contactless travel corridor and a kiosk performs the same process.

“What started off as a project to reduce travel congestion and keep passengers moving is now going to help keep people safe in a pandemic world through social distancing and contactless interaction,” said iProov founder and CEO Andrew Bud.

“It’s yet another example of how opt-in facial verification is making life easier and safer for people around the world.”

Facial recognition technology has long come under fire, particularly with regards to its use in law enforcement. Privacy activists are particularly concerned that implementing the technology without oversight could constitute an intrusion into people’s daily lives.

Objections have also been raised over the alleged racial biases found in the software, with people of ethnic minorities also concerned it could lead to abuse by police forces embedded with systemic racism.

The company maintains that it doesn't use facial recognition, but facial verification. The difference, iProov says, lies in the way its system verifies users' identities against their documents, which involves a different technological procedure.

The technology iProov uses involves something known as ‘controlled illumination’ to authenticate users’ identity against their identity documents when passing through the biometric entry corridor.

This process checks whether the user is a real person, rather than a photo, video or wearing a mask, as well as checking if the user is asking to be authenticated there and then. This is in order to protect against the prospect of criminal attacks using deepfakes.

Upon successful authentication, passengers would receive a message confirming their identity had been secured, and that a ticket or passport would not need to be shown again until they reached their destination.

Speaking on potential ethical concerns, executive director of the Open Rights Group (ORG) Jim Killock said the public would need to understand what the data retention and sharing procedures would be.

"Surveillance and biometric surveillace at our borders are becoming more instrusive over time, and systems like this tend to stay in place in one form or another," he told IT Pro.

“At the very least a clear path to closing such systems and deleting the data collected specifically for this pandemic should be in place."

The system has already been trialled in airports to increase the speed and security of the immigration process and is being ported to train travel as part of a competition run by the DfT and Innovate UK.

The platform will be developed in a close partnership between iProov, Eurostar and Candian travel and immigration tech specialist WorldReach. The system will be in live operation by March 2021.

Amazon is to pause the police use of its AWS facial recognition software Rekognition following two weeks of intense protests against police brutality and the murder of George Floyd on 25 May.

The tech giant announced that it would be implementing a one-year moratorium on the technology, making an exception for organisations such as the International Center for Missing and Exploited Children to use Rekognition in helping rescue human trafficking victims.

The use of facial recognition software by police forces has been long marred with allegations of racial bias, which many human rights organisations argued has a disproportionately adverse effect on non-white people. Amazon Rekognition, in particular, has been criticised for struggling to identify the gender of individuals with darker skin.

In a statement on Amazon’s blog, the company said that “governments should put in place stronger regulations to govern the ethical use of facial recognition technology. We hope this one-year moratorium might give Congress enough time to implement appropriate rules, and we stand ready to help if requested,” it added.

It's currently unclear how many police forces use Amazon's facial recognition technology, although Rekognition marketing does make it clear that it works well with body-worn cameras.

In February, IBM and Microsoft were the first two technology industry sponsors of the Vatican’s principles promoting the ethical, unbiased, and transparent use of AI.

Microsoft has yet to ban police use of its facial recognition technology, however, speaking to IT Pro earlier in the year, the company revealed that it had rejected applications from US police forces in the past.

"A police force in the United States came to us and they use body cams, which is considered to be a very good way to create accountability and transparency," explained John Frank, vice president of EU Government Affairs at Microsoft, at a press event in March. "We came to the conclusion that the cameras, and the variable situations in which they’d be used, would not produce good enough images to be able to have an accurate system. And we know that in the United States there's over-policing of racial minorities and that racial minorities would be most at risk of having a false positive from the system."

"I do think that police forces want to do the right thing," he added. "But they need to understand [the technology]. This goes back to the disclosures that the companies make about what it's designed for and what it's capable of doing."

IBM had decided to scrap its general-purpose facial recognition and analysis software suite earlier this week, citing similar ethical concerns. The U-turn decision came after years of effort put into developing the AI-powered tools, but the decision was made due to fears that the tech could be used for purposes that go against IBM’s principles of trust and transparency.

“We believe now is the time to begin a national dialogue on whether and how facial recognition technology should be employed by domestic law enforcement agencies,” CEO Arvind Krishna outlined in a letter to the US Congress.

Nicole Ozer, technology and civil liberties director of the American Civil Liberties Union of Northern California, welcomed Amazon’s decision.

“Face recognition technology gives governments the unprecedented power to spy on us. We urge Microsoft and other companies to join IBM, Google, and Amazon in moving towards the right side of history,” Ozer said in a statement.

The Metropolitan Police's plans to use live facial recognition (LFR) on London streets has been slammed by privacy campaigners as a "serious threat to civil liberties".

The Met Police said last week it would soon begin operational use of live facial recognition in London, using technology from NEC to tackle serious crime.

The standalone LFR systems will be used in specific, targeted areas to look for offenders on a watch list. The use of LFR cameras will be announced via signs while officers will hand out leaflets; images of passersby won't be collected or stored.

“We all want to live and work in a city which is safe: the public rightly expect us to use widely available technology to stop criminals," said Assistant Commissioner Nick Ephgrave in a statement.

"Equally I have to be sure that we have the right safeguards and transparency in place to ensure that we protect people’s privacy and human rights. I believe our careful and considered deployment of live facial recognition strikes that balance."

Others disagree that the system strikes that balance. Silkie Carlo, director at Big Brother Watch, said the move "flies in the face" of an independent review that deemed police use of facial recognition was likely unlawful and 81% inaccurate.

"This decision represents an enormous expansion of the surveillance state and a serious threat to civil liberties in the UK," Carlo said. "This is a breath-taking assault on our rights and we will challenge it, including by urgently considering next steps in our ongoing legal claim against the Met and the Home Secretary."

She added: "This move instantly stains the new Government’s human rights record and we urge an immediate reconsideration."

London mayor Sadiq Khan has previously spoken out against facial recognition on a private residential development at Kings Cross, writing to the developer to raise his concerns. However, in response to the Met's plans, he said City Hall will merely monitor its use.

"New technology has a role in keeping Londoners safe, but it’s equally important that the Met are proportionate in the way it is deployed and are transparent about where and when it is used in order to retain the trust of all Londoners," he said in a statement.

The Information Commissioner's Office said it would also be keeping a close watch, but said the Met had taken on-board its previous advice about avoiding privacy intrusion. "This is an important new technology with potentially significant privacy implications for UK citizens," the ICO said in a statement. The watchdog added that the use of facial recognition may meet the threshold of "strict necessity" if it is well-governed and used in a targeted way.

One of the concerns with facial recognition beyond surveillance is its inaccuracy — it often simply doesn't work. One review of a trial by police looked at 42 uses, finding just eight were accurately identified.

“Most times they didn’t actually find the people they were looking for," Daragh Murray, a lecturer at the University of Essex who wrote the report, told the New York Times. "From just a technological perspective, you have to question the utility."

The move by the police to use live facial recognition comes amid other cities banning the technology, as Europe considers a five-year moratorium to allow regulations to be put in place, and as British MPs call for a ban until issues such as bias and data retention can be addressed.

Google is toying with adding biometric support to its Autofill service on Android devices, deployed by users to automatically populate online forms and apps with personal and sensitive information.

Android code that hasn’t yet been enabled suggests Google’s built-in service could, in a future update, introduce an additional security layer involving fingerprint scanning or facial recognition, according to XDA Developers.

The additional step would be handled through the ‘BiometricPromptAPI’, and would aim to resolve a security concern that has riddled Google’s auto-fill feature for years.

Autofill allows Android users to automatically populate forms and apps with information like passwords, addresses and credit card details, that's synced with their Google account.

With Google’s Android 8 Oreo operating system, the inclusion of an Autofill API opened up support to third-party password managers like LastPass and Dashlane.

Using the equivalent of Autofill with these apps, however, generally requires users to pass an additional layer of security, like a quick fingerprint scan, to verify their identity.

Unlike these third-party apps, however, Google’s own feature has never demanded any additional form of authentication.

Attackers, therefore, could in theory gain access to a wealth of sensitive information - including financial data - by just bypassing the passcodes users set that allows access into their devices.

According to an APK teardown, biometric support options would be enabled within the Autofill settings portion of the Android settings menu, under ‘autofill security’.

Users could then separately toggle biometric support on or off for payment information and credentials like usernames and passwords.

Biometric security is increasingly being seen as a reliable and secure alternative to traditional passwords and passcodes. The use of password managers, too, is often recommended by security experts as a means of improving cyber hygiene.

Microsoft, for instance, is a company that’s been highly vocal about the need to shift away from conventional passwords and for users to instead embrace biometrics as an alternative. Its chief information security officer Bret Arsenault has in the past called for online passwords to be eliminated entirely.

Embracing biometric support completely, however, presents its own security challenges, as the Biostar 2 data breach showed, with the nature of the biometric data taken for more permanent than usernames and passwords, which are stolen in most other breaches.

In the first six months of 2019 alone, there were more than 3,800 publicly disclosed data breaches according to a report from Risk Based Security. In total, these breaches exposed 4.1 billion compromised records. In 65% of those breaches, passwords were included within the leaked data. Passwords alone are – as regular readers will know – about as secure as storing your valuables in a tent.

The problem is most people remain blissfully unaware of that fact and continue to use, and reuse, those same passwords that are now in criminal circulation. Stolen passwords quickly end up on the dark web, to be sold or freely circulated within the cybercriminal community. When Google was beta-testing its Password Checkup extension for the Chrome browser, in a single month it found 316,000 compromised passwords that were still in use. The Verizon Data Breach Investigations Report 2019, meanwhile, determined that weak or compromised passwords were used in 80% of all hacking-related breaches.

But what should passwords be replaced with?

The passwordless promise

“There will likely always be a need for passwords to some degree,” says Javvad Malik, security awareness advocate at KnowBe4, “whether that be as a backup mechanism or a means to initially pair physical devices”.

Sam Curry, chief security officer at Cybereason, agrees: “We’ve tried for 25 years to get there, and the clock is still ticking. The closest we’ll come in the short term is potentially an interstitial proxy layer that presents to the user both something easier to use and more secure than human-managed passwords while managing large, complex, frequently changing passwords on the back end.”

Microsoft obviously sees that proxy layer as a biometric one, facial recognition specifically. In May 2019, Microsoft’s crypto, identity and authentication team group manager, Yogesh Mehta, stated that “nobody likes passwords, except hackers” and announced that Microsoft was moving the 900 million people who use Windows 10 “one step closer to a world without passwords”.

Ever since 2015, Microsoft has been headed in this passwordless direction, notably with the introduction of Windows Hello. In November 2018, Windows 10 users started being able to securely sign into their Microsoft accounts on the web using facial recognition, without a password having to be entered. With the release of Windows 10 v1903, Windows Hello became a fully FIDO2-certified authenticator.

Google also signalled an intent to move into biometric territory when, in August 2019, a Google Online Security Blog announcement informed Android users that, when visiting certain Google services online, “you can verify your identity by using your fingerprint or screen lock instead of a password”. Another example of FIDO2 authentication in action, this marked the first time that Google had enabled the same biometric credentials to be used by native Android apps and online services. The big question is: are the technologies that are being used in that “proxy layer” role actually any more secure?

How secure are biometrics?

The obvious replacement for passwords comes in the form of what you can collectively refer to as biometrics: any technology that uses the metric of individual human characteristics. For the longest time, fingerprints were the cutting edge of biometric security. However, there’s been something of a pivot away from the fingerprint scan of late as companies such as Apple with the iPhone, and now Google with the Pixel 4, have removed the option from their smartphones in favour of facial recognition.

There are as many design aesthetic and production cost reasons for this as there are security ones. But fingerprint technology has been notoriously flaky from the get-go. Germany’s Chaos Computer Club (CCC) first described a method of fooling fingerprint ID systems back in 2004. This involved photographing a fingerprint and laser-printing it to a transparent sheet using a thick toner before covering in a layer of latex “milk” to produce a fake print. By breathing on this latex print (yes, seriously), it became moist enough to fool most fingerprint sensors at the time. In 2013, CCC used the same technique to fool the iPhone 5s Touch ID. More recently there have been reports of neural networks generating “DeepMasterPrint” artificial fingerprints that could successfully imitate one in five prints in biometric systems, where the error rate should be no more than one in a thousand.

However, you don’t always have to go to elaborate lengths to bypass the fingerprint scanners. Like the discovery that a cheap, £2.70 gel screen protector could leave the ultrasound-scanning, 3D ridge-detecting, fingerprint security of the Samsung Galaxy S10 as good as useless. If the user registered a print with the screen protector in place, anyone else could then unlock the phone. Samsung soon fixed this issue via a patch sent directly to affected users, but it shows the flaws in fingerprint tech.

Which isn’t to say that facial recognition is foolproof, either – far from it. One Forbes journalist managed to fool a number of facial recognition systems using a 3D-printed copy of his head, for example. There are far less outlandish ways to trick facial recognition, too. The Google Pixel 4 smartphone has a face unlock system and no fingerprint security. Shame, then, that early reviewers found it allowed access to the device even if the user had their eyes closed! It doesn’t take a genius to work out how this could be a security flaw, as we all have to sleep.

Apple’s Face ID is supposedly not so easy to fool, yet at the Black Hat Las Vegas hacker convention in 2019, security researchers demonstrated how a pair of spectacles, some tape and a sleeping iPhone user were all that was required to do just that. This was because the “liveness” part of the Face ID process didn’t extract all the 3D data if the owner wears glasses; rather it looked for a black area for the eye with a white dot for the iris. The hackers recreated this by covering the specs in white tape with black in the middle and then making a hole in that black tape. Dutch researchers found that 42 out of 100 smartphones tested could be fooled just by holding up a photo of the owner’s face.

One emerging new technology that I’ve been looking at recently, or rather an established biometric technology with a twist that could see it become more mainstream, is what Hitachi refers to as “hand gesture biometrics”. This couples the well-established biometric of finger vein recognition with a system that works on any device that has a camera; smartphone, laptop, desktop or standalone entry system. While you might not have heard of finger vein biometrics, it’s been a thing since 1997 when the technology was used in Japanese ATMs; many banks around the world have already replaced passwords for transaction authentication using it. It differs from fingerprint scanning in that instead of mapping the external surface of the finger to register all the ridges that make your fingerprint unique, it reads the patterns of the veins inside the finger using ambient or infrared light instead. It’s also much harder to fool than fingerprinting as this type of scanning demands dynamic blood flow rather than a static copy.

Harder isn’t impossible, of course. I have written before about how vein authentication that reads your palms has been bypassed. Researchers at the Chaos Communication Congress in Berlin demonstrated a method making a wax hand from 2,500 photos taken with the infrared filter removed from the camera in order to capture the vein pattern. By printing the patterns and layering over them with beeswax, the researchers simulated human tissue well enough to fool some vein-recognition systems. How easy it would be, in the real world, to capture those 2,500 images without the target being aware of it is a whole other debate.

Ravi Ahluwalia, general manager at the Hitachi Security Business Group (EMEA and NA), told me that there are “several methods of detecting the presentation of pictures and fake hands,” although wasn’t inclined to reveal what these were for obvious reasons. The technology is compliant with ISO/IEC 30107-3, the industry standard for testing of “Presentation Attack Detection”, though. What’s for sure is that capturing and cloning an internal biometric is much harder than an external one.

Then there’s the usability and cost argument for such a technology, which is where most new biometric developments falter; it’s hard to get an easy-to-use technology into something like a smartphone at a cost that makes it economically doable. The hand gesture technology utilises the existing smartphone camera without the need for any additional sensors and works by the user simply waving their hand in front of it. No hardware tokens, smartcards or biometric readers required. The Hitachi system then creates a dataset description with a proprietary one-way algorithm to produce an encrypted template rather than an image of the vein patterns. An encrypted template that’s useless to an attacker as no usable biometric data is stored within it is an important consideration following the recent breach in the biometrics system used by banks and the police, which exposed the fingerprints of more than a million citizens. The camera might be seen as a weak point here, but even if that were compromised all the attacker would get is a video stream. To exploit the authentication process itself, an attacker would need a level of access to, and control of, the device; and that would mean security was totally compromised already.

Stronger passwords

Bill Lummis, technical program manager at bug bounty platform HackerOne, said that “passwords are the worst option for secure authentication,” adding “except for all the others”. He’s convinced that, for the foreseeable future, we will just have to continue trying to make passwords work. “Organisations can do their part by implementing and pushing, or even mandating, two-factor authentication so that even if passwords are breached, the damage is contained,” he said.

Robert Capps, vice president at NuData Security, is also of the opinion that passwordless is a way off yet. He sees most additional authentication layers such as single-use codes created by an app, or sent via text message, as “patches to an outdated authentication framework in dire need of replacement”. Until there’s a replacement for user authentication that allows them to assert their true identity, we’ll continue to use username and password solutions, “albeit with more features tacked on, such as physical biometrics”.

I spoke to Aaron Cockerill, chief strategy officer at security vendor Lookout, who talked of the one thing that needs to be more effectively dealt with as we move to a passwordless world: what he calls continuous authentication. “If we are to make changes to the way we identify people through authentication,” Cockerill said, “we need to ensure the new systems continuously assess identity.” Smartphones are ideally suited to this, being a little box of sensors, and could “continuously analyse whether the person that originally authenticated to a system is the same person using it now”.

Samsung might have the first technology that will make this viable. A recent patent reveals that it’s developing a technology that would essentially allow “instant” two-factor authentication. As a user enters their password or PIN, their fingerprint is simultaneously being scanned as a secondary authentication method. This isn’t as daft, or insecure, as it sounds. By reading the fingerprint(s) of the user inputting the password, that second layer of authentication ensures it’s the actual user rather than someone with access to the device.

It’s not yet clear when the tech will come to market as the patent includes a number of options. A single, small, fingerprint reading input area where the numbers or digits scroll across and are input when pressed, being one of them. Given that Samsung is already talking up larger in-screen fingerprint sensors for the next-generation of Galaxy devices, I prefer the option of having a large authentication area that reads the fingerprint whenever the user is typing, entering a PIN or even a “swipe” pattern. I doubt this is something we’ll see in 2020, but 2021 certainly seems more than doable.

Maybe the password isn’t dead, after all

Cyber security company Kaspersky has released its predictions for the 2020 threat landscape, noting that cyber attacks are going to become more targeted and increasingly sensitive data leaks will proliferate.

The security firm believes that the trend towards more targeted attacks that have been observed for the past few years will continue and attackers will continue to build their banks of information with biometric data from new breaches.

As biometric technology becomes more prevalent in the technology used by individuals and businesses every day, there is an increased likelihood of the data these scanners collect being leaked.

"Not every adversary has a complete profile of potential victims to abuse, which makes the increasing amount of leaked data very valuable," said Kaspersky.

The trend towards targeted attacks has been especially evident in ransomware which has strayed away from aimless targeting methods to a more methodical approach.

Targets have shifted to the wealthier organisations that have more to lose and are more likely to provide big payouts for quick release of their sensitive data, an act condemned by the industry but often works.

"Throughout the year, we recorded several cases where attackers used targeted ransomware, and we think that a likely future development will be more aggressive attempts to extort money," said Kaspersky. "A potential twist might be that, instead of making files unrecoverable, threat actors will threaten to publish data that they have stolen from the victim company."

Given the success of ransomware in recent years as a tried and tested business model, it’s unlikely that the rate of attacks will decline. Ransomware has been among the top attack vectors for some time but last year it's targeting of UK businesses soared by 195%.

Aside from ransomware, the security company recognised that the shift from data storage has gradually moved away from PCs and servers and more into mobile devices which is why it expects attacks to focus on these devices more in 2020.

Kaspersky cited the 14 vulnerabilities in Apple’s iOS exposed by Google this year as an example of how the focus is shifting to mobile.

Attackers will always go where the valuable data is and it’s ‘only a matter of time’ before more sophisticate mobile attacks are seen more in the wild.

"There are no good reasons to think this will stop any time soon," said Kaspersky. "However, due to the increased attention given to this subject by the security community, we believe the number of attacks being identified and analyzed in detail will also increase."

Attacks are also expected to proliferate on other non-PC targets such as VPN software, networking hardware and other infrastructure.

DNA-screening company Veritas Genetics has suffered a security incident in which a hacker accessed and potentially stole customer information.

The company declined to specify what sort of information was compromised as a result of the data breach, although did clarify that no genetic data, DNA-test results or health records were accessed.

Although there are a host of DNA-screening services, companies such as Veritas and 23andMe set themselves apart by claiming to offer customers a full analysis of the human genome. This amounts to examining all 6.4 billion letters, as opposed to just a fraction of the genetic information, as is conventional practice.

"The security and privacy of customer information is a top priority, and we have security processes and procedures in place as part of this commitment, including segregating and securing genomic data on separate systems," the company said in a statement.

"Our forensic investigation is ongoing, and we will notify any potentially impacted individual as appropriate under applicable law."

The startup's customer-facing portal had recently been accessed by an unauthorised user, the company confirmed, although it didn't specify when it became aware of the incident, or how long the system had been exposed.

The firm added that its security processes were robust, and these included segregating and securing genomic data on a separate system to customer information.

"Based on our investigation to date, only a handful of customers were potentially impacted, no genome sequences or genomic data or Veritas test results in any format were accessed and no customer information has been used inappropriately," Veritas continued.

"It is important to note that Veritas Genetics does not store credit card information in its systems.

"Our forensic investigation is ongoing, and we will notify any potentially impacted individual as appropriate under applicable law. We are also considering legal action against the perpetrator and will explore all available legal recourse based on the findings of our investigation."

As services like Veritas Genetics' genomic analysis become more widely-used, there are mounting privacy and security concerns around how tightly-guarded this information is.

Accessing such information could, for example, inform cyber criminals about any medical conditions or genetic issues individuals may have. This could, in some instances, lead to subsequent blackmail attempts.

Similarly, support for biometric security is gaining velocity as an alternative to conventional password security. Experts in the field are concerned, however, with the sense of permanence that is associated with hackers stealing this data.

There are manual ways of replicating a fingerprint, according to German hacking group Computer Chaos Club, although this is laborious and time-consuming. When Apple's Touch ID has first launched six years ago, the outfit demonstrated that one can copy a fingerprint from an existing surface, clean it up using graphite powder, take a high-rest photo and print it off at a high resolution on latex material.

It's nothing compared with a security incident earlier this year, in which the pre-stored biometric information of more than one million people was leaked. Fingerprints and facial recognition information, as well as unencrypted passwords, were exposed when the Biostar 2 database was accidentally made unprotected.

IT Pro has approached Veritas Genetics for more information surrounding the data breach.

Strong Customer Authentication (SCA) is a mechanism introduced by the European Union (EU) requiring financial services companies in the European Economic Area (EEA) to employ additional security measures on customer payments of more than £30.

SCA, which falls under the EU's Second Payment Services Directive (PSD2), originally came into force on 14 September 2019 with a fairly limited scope, only to be steadily extended over the following years. The goal of the directive is to increase the cyber resilience of financial services, forcing them to adopt standardised security practices and tools and ensure customers receive the same degree of protection regardless of where they choose to do their banking or which services they use for e-commerce.

The directive requires financial services to adopt additional layers of security for online transfers, mainly in the form of multifactor authentication (MFA), although companies can adopt derivatives of this technology provided they offer robust protection. For example, companies are allowed to deploy biometric technology, as is the case with Natwest, which analyses how customers typically interact with their devices when making purchases and uses this data to confirm their identity.

The Financial Conduct Authority (FCA) started to enforce SCA in the UK from 14 March 2020, although this initially only covered online and mobile banking. It wouldn't be until 14 March 2022, once the effects of the pandemic had subsided, that the full scope of the directive would come into force, covering e-commerce transactions for the first time. This was originally due to happen on 14 September 2021.

Direct debit payments, and similar transactions initiated by merchants and vendors, do not fall under the scope of SCA and are otherwise unaffected.

It's hoped that the SCA changes around additional layers of security will significantly reduce instances of fraud, mainly by forcing users to confirm their identity through a variety of verification checks, whether that be token-based, biometric, or an equivalent technology. Fundamentally, any customer who buys goods online, sends money over the Internet, accesses their bank account online, or otherwise engages in an activity likely to create a risk of fraud, should be protected under SCA.

The upshot is that if a customer deals with a financial service provider that has failed to introduce additional layers of security, transfers are likely to be rejected.

What need is there for SCA under PSD2?

There's been an explosion of people in the UK using mobile devices to access financial services and make payments in the last few years. This feeds into a wider trend that has also seen the use of cash fall dramatically, with debit card payments eclipsing cash transactions for the first time in 2017.

According to the British Retail Consortium, card payments account for more than three-quarters of all retail sales last year, and further research predicts that cash will account for just 9% of purchases from 2028.

Modern card transactions are already covered by something equivalent to SCA through the Chip and Pin mechanism, but this has yet to extend to online payments.

There has also been a growth in digital banks like Monzo, which don't have any physical branches and instead run exclusively online. Approximately one in ten in the UK are estimated to have an account with a digital-only bank, with a quarter of the population projected to have one by 2023.

How does this regulation keep money safe?

Using banknotes has always been straightforward, from a verification point of view, given we physically hand these over to merchants or service providers when paying for goods and services. The digitising of cash has added complexity to this process, however, and it’s becoming harder to ascertain the legitimacy of payments when they’re increasingly being made over the internet.

Although digital payments are much easier for many consumers than traditional forms of payments, the level of fraud has also risen substantially. According to UK Finance, losses on UK bank cards exceeded £671 million - equivalent to a 19% increase from 2017.

This regulation specifically aims to address the rising spectre of fraud, with SCA under PSD2 affecting many aspects of digital payments and transactions when it comes into force across the whole payments industry. The directive also applies in the UK regardless of Brexit, mainly because the country’s biggest financial institutions have sought to remain aligned with the EU under any circumstances for fear of losing business.

SCA introduces the need for MFA to be used on any payment totalling more than £30, with the second factor used to verify the transaction is legitimate. This is perhaps the most significant change in the regulation. This process can entail a PIN number being used in combination with a mobile phone or credit card, but verification could even come in the form of something like a fingerprint scan.

Don't we already have MFA for banking in place?

MFA, currently, exists in the form of 3D Secure (3DS), used mainly for credit card transactions, but is only deployed in cases where there's an obvious risk of fraud. When making online purchases, for instance, a second action window may open and ask for further details. This can often be frustrating when in-browser and while browsing on a mobile device due to poor configuration. A revised version allows for biometrics (fingerprint or face), which is more amenable to phone users.

3DS also offers the ability for the seller to opt-out of the second verification factor, making transactions smoother, but reducing the security element and potentially putting buyers at risk.

PSD2 abides by a different set of regulations, with transactions under £30 passing without the SCA's MFA requirement, but beyond that, the rules dictate there should be a mandatory request for another form of verification.

The likelihood of a second factor being needed is based on the fraud rate of the acquiring bank and the issuer. The less fraud a bank experiences, the more you can spend before a second factor is required. Crucially, the merchant no longer has a say in whether they require MFA from their users or not. Moreover, every fifth transaction below that £30 threshold will be challenged, as well as when the combined value of transactions exceeds £100.

How to secure payments under SCA

An updated version of 3DS, dubbed 3D Secure 2 (3DS 2), arrived in 2019. This newer standard aims to reduce some of the added frictions that MFA could bring without compromising on necessary security.

3DS 2 functions by allowing more information to be sent from a provider to the customer's bank. This may include details specific to the payment, like the shipping address, as well as drawing on contextual information like device data, transaction history, server information, and even the time zone. All these details feed into a risk assessment run by the customer's bank as part to determine whether additional authentication checks are needed.

By default, any payment process that already uses MFA should be compliant under the SCA directive, like the swathe of digital banks that require biometric verification, or services like Apple Pay.

There are a host of exemptions to the SCA directive, however. For services that rely on recurring payments or subscriptions, MFA only needs to be applied to the first customer-initiated payment.

It's important to remember that the cardholder's bank decides whether MFA is required and whether an exemption from SCA is valid.

What does SCA under PSD2 mean for everyday banking?

SCA aims to harmonise user protections and reduce fraud, which is a good thing for both consumers and employees, but also for banks and merchants too.

Sellers might also want to switch to banks that have lower fraud rates, so as to minimise the need for MFA and reduce payments friction. This might lead banks to be sharper at reducing fraud, which is, again, a very good outcome for the industry as a whole.

"The biometric data, unencrypted passwords, and personal data of over one million people have been discovered sitting on a publicly accessible database belonging to a company that serves the likes of the UK Metropolitan Police and banking groups."

Those were the familiar words I typed out as part of my coverage of the Biostar 2 data breach. It's the same narrative I've seen hundreds, if not thousands, of times since becoming a technology journalist in my numbness I even entertained the idea that one million wasn't too bad.

But the Biostar 2 incident is perhaps the most unique security lapse I've come across in my three years at IT Pro. Not because of how it was discovered, nor because of how many were affected. The security lapse itself is even quite common.

What's uniquely terrifying about this breach is the nature of the data that was stolen.

Data breaches and hacks have become so common now that they fail to spark the same outrage they once did. That's not to say people don't get angry when they see a national airline exposing data to the world, or a massively popular social network improperly sharing information to third parties. Yet, for all that initial vitriol, the story disappears soon after. The number of those affected is usually difficult to conceptualise and, by extension, relate to. The privacy impact on each customer also varies significantly.

The initial buzz around the headline is usually followed by the release of fixes, process improvements, and the occasional lawsuit, only for attention to eventually turn elsewhere. Only very rarely does a data incident reverberate in the minds of the public. Facebook's Cambridge Analytica scandal comes to mind. Yet for most, we forget.

And that's ok.

The reason we forget is that the data itself is mercurial. The likes of passwords, email addresses, ID numbers, web history, and user preferences, while unique to each of us, can all be changed relatively easily or at least can go out of date quickly. Financial data theft, of course, can be more damaging but, again, cards can be cancelled and security numbers scrapped. It's also true that data theft for the majority of us usually translates into the odd dodgy phishing scam; often hilarious, always dismissed.

There's also the derision that accompanies scams that exploit password reuse. Those of us that turn to password managers, mainly so that we can fire and forget whenever we sign up to a new service, can be safe in the knowledge that it's those who are uninformed or lazy in their approach to security that will feel the brunt of most hacks.

But the Biostar 2 data leak exposed us all to something a little more sinister and, I would argue, is one of the most serious vulnerabilities ever discovered. Here we had raw, non-hashed fingerprint data and facial scans sat on a vulnerable database, information that is entirely unique and (outside experimental surgery) can't be changed. We've all resigned ourselves to the fact that companies will slip up when it comes to data protection, but when that extends to the very data that makes us individuals, serious questions need to be addressed.

The incident will certainly have implications for the biometrics industry. The drive to go passwordless may improve user security and user experience, but there seems to be little consideration as to how much more sophisticated data collection and storage will need to be as a result. In fact, many companies, including previously respected household names, have demonstrated unprecedented incompetency when handling our data, and it's time we started taking that seriously.

We have to question whether we should allow software vendors to continue to digitise more and more of our immutable personal information in the pursuit of state of the art services, many of which are entirely unnecessary.

Human rights groups have warned Manchester City football club against introducing facial recognition technology over fears of "normalising a mass surveillance tool".

The Premier League champions have suggested installing the technology in the Etihad stadium to speed up the entry process, allowing fans to get into the home games by scanning their faces instead of using paper tickets, according to The Sunday Times.

However, Liberty has called it a "disturbing move" suggesting it subjects football fans to intrusive scans just so they can watch a football game.

There are also questions being asked about the company City have reportedly hired to implement the technology - Texas-based Blink Identity.

Hannah Couchman, the policy and campaigns officer at Liberty, told The Guardian: "It's alarming that fans will be sharing deeply sensitive personal information with a private company that boasts about collecting and sharing data on each person that walks through the gate and using this to deny people entry.

"Manchester City should urgently reconsider their involvement in normalising a mass surveillance tool which can track and monitor us as we go about our everyday lives."

City's Etihad stadium has a capacity of 55,097 and as the home of the reigning Premier League champions, is regularly sold out. IT Pro has contacted the club for comment.

Blink Identity says it has been building and deploying large scale biometric identification systems for the last decade, starting in the Middle East for the US Department of Defense, and more recently to commercial markets for security and access functions.

The company says its technology is "revolutionary" and can track users at normal walking speed. The system works in half a second (a blink - hence the name) and doesn't require the user to look directly at the camera, rather it captures you as you enter.

It also calls it "privacy-first facial recognition", stating that "privacy is part of our culture". While Blink Identity claims to be ethical and transparent with your data, there is little information on their website about what actually happens to your data - it says it deletes data if it doesn't have an agreed-upon "business use" but does store some personal data.

From the perspective of personal data, facial recognition has presented a problem for regulators. Recently, the ICO announced it was looking into facial recognition deployment by police, as well as its use by a property developer at King's Cross.

This is not the first time the technology has been used in football. The South Wales Police deployed the technology at the 2017 Champions League Final in Cardiff. That was part of a wider trial, which included the Metropolitan police which proved controversial, partly due to how unsuccessful it was.

Amazon Web Services has revealed an update to its facial recognition software, Rekognition, that can detect a person's fear.

This update was announced on Monday along with improvements to accuracy and functionality of its facial analysis feature that can identify gender, emotions and age range.

The company claims the software can already accurately read seven 'emotions', but it has now added an eighth - the ability to spot fear.

However, some experts have pointed out that while there is scientific evidence that suggests there are correlations between facial expressions and emotions, the way they're communicated across cultures and situations can vary dramatically.

"Today, we are launching accuracy and functionality improvements to our face analysis features," the tech giant said. "Face analysis generates metadata about detected faces in the form of gender, age range, emotions, attributes such as 'Smile', face pose, face image quality and face landmarks.

"With this release, we have further improved the accuracy of gender identification. In addition, we have improved accuracy for emotion detection (for all 7 emotions: 'Happy', 'Sad', 'Angry', 'Surprised', 'Disgusted', 'Calm' and 'Confused') and added a new emotion: 'Fear'"

The ethical use of facial recognition, and its accuracy, particularly when deployed on a crowd, has caused concern throughout the world. From the London Met Police's use that resulted in zero arrests and a 98% failure rate, to San Francisco's outright ban of the technology, it's now more famous for its problems than its benefits.

The UK's Information Commissioner (ICO) has announced an investigation into the privacy aspect of facial recognition, which came to light this week after the owner of a development site in King's Cross confirmed the technology was being used.

Amazon's own Rekognition has also been a source of controversy after it was revealed that US law enforcement used the technology. There was even reports that AWS tried to offer the software to the Immigration and Customs Enforcement organisation, which sparked protests from Amazon staff.