Biometric borders: the price of crossing over

A password can be reset, but your fingerprints? Once stolen or misused, they’re gone for good. And yet, we keep handing them over at borders, airports, and even our own devices.

Since the world opened up again post-pandemic, we’re able to fly to Beijing, Shanghai, and Shenzhen as we please, visa permitting. But that’s all they require, right?

Far from it, my friend. You arrive at the gates and they want your fingerprints. Both hands. They scan your iris. They say your name and wave you through. Simple as that.

Biometric data collection is on the rise worldwide, not just in China. And unlike passwords, fingerprints cannot be changed.

But is it just China that we should be dubious about, with their privacy looting, based on a reputational stereotype with profiling all their citizens?

Surveillance: East vs West

Surely, the US's current political situation doesn’t give them a free pass in this. And it can’t be a case of one system being worse than the other.

In China, fingerprints are tied to national ID systems. The state then has an extensive database of biometrics that is tied to you for a lifetime.

You can’t change it like a password. So it’s not just about a scan at an airport, every transaction you make and what you say in public is captured too – call it behavioral scraping.

Hanna Bosakov, an encryption specialist and CEO at encrypted email provider Tuta, summed it up to Cybernews:

“China is famous for its social credit system, which it uses to control people and to create accepted social behavior. The state holds all the data and can do with it whatever it wants. In an authoritarian system, this is what people are used to.”

Smart cities and social credit systems are the way with a top-down approach – sure the streets are clean but don't you dare utter a word of dissent. Conversations with friends privately could be surveilled and tracked back to the fingerprint, like digital branding.

How about the US in this case? Well, here, it’s under the pretense that we can trust big tech. The usual players, Apple, Google, Amazon, and others, collect and store your biometric data.

Bosakov explains: “In the US, data collection is more subtle and not as easily understandable because the corporate-driven model that we have in the West is not as centralized, but we are getting closer.”

In terms of government access, the FBI and TSA often collect your prints, sometimes without clear consent. Even though it’s not as pervasive as in China, it’s still part of the furniture.

Fingerprints for sale

In 2015, there was a huge data breach in the Office of Personnel Management, as millions of fingerprints, dates of birth, and home addresses were exposed. The malware had been residing in the servers for around three years, and the data exfiltration was heavily linked to the Chinese state.

A fingerprint database is an attractive target for hackers. Even if national cybersecurity is robust, it isn’t impenetrable. And it’s not limited to the US and China – Japan, Mexico, and India have all had fingerprint and iris data breaches over the last few years.

So what’s worse in all of this – a government that can monitor you openly, whereby you know exactly what you’re signing up for – or companies that sell your biometric data?

Bosakov points out: “The entire internet is built to monitor people – except for some privacy-first services. All the data we share is made into a profile that can be used by third parties for who knows what. Right now, the main purpose is digital advertising, but this can change anytime.”

In China, biometrics are integrated into everyday society, whereas in the US there’s a lot more inconsistency and unknown quantities. In that case, which system is more covert and suspect?

Goodbye, anonymity

Historical narratives of the Cold War and spy movies may have shaped our finger-pointing, but perhaps it’s a generational divide. When there was a recent migration away from TikTok, many videos were made in ironic jest proclaiming “goodbye my Chinese spy” – public surveillance is common knowledge.

And who is to say that we’re not going to have an international database of fingerprints? Not to mention corporate misuse, companies could target you with whichever form of advertising or rhetoric they wish.

There’s scope for hyper-personalized advertising, price discrimination, access control and restrictions, health records, financial history, social media records, insurance and credit scoring, reputation management, and security risks.

So if you’d like to “move freely” between countries, expect every movement to be catalogued. Despite the EU having stronger privacy policies than the US and China, it doesn’t stop your fingers and eyes being scanned as you pass through the borders.