Biometric recognition systems aren't that safe, Europol says

Biometric recognition technology offers a trusted and reliable way to verify our identity and protect our devices and online accounts. However, law enforcement agencies and the public must also acknowledge that biometrics introduce new threats as well.

Fingerprint scans, facial recognition – biometric recognition technology is increasingly replacing passwords to make logging in, authenticating our identity, or confirming payments more convenient. Because of a fingerprint’s or face’s unique characteristics, biometric recognition systems are generally considered robust.

However, biometric technology isn’t without risks and has vulnerabilities that can be used for criminal abuse, like impersonating a legitimate user or evading detection. In fact, crimes facilitated by biometric presentation attacks are on the rise.

Europol has published a report discussing how criminals might exploit any weaknesses that surround biometric technology. For example, a fingerprint can easily be replicated with a silicone mold. A digital fingerprint can be printed in 2D, 2.5D, or 3D as this technology becomes available more widely.

Biometric recognition systems can also be fooled by customized silicone masks, makeup, face morph software, or deepfake technology. The latter has been used to generate synthetic speech to impersonate an individual and evade detection.

“Criminal abuse of biometric recognition technology requires the appropriate response from law enforcement to ensure that we remain on the front foot, both in order to fight crime and to keep our systems as resilient as they currently are,” says Catherine De Bolle, Executive Director of Europol.

To stay ahead of the curve, law enforcement agencies need to collaborate with experts in the field to get their insight into possible attacks on biometric recognition systems. Therefore, authorities have to invest in raising awareness, monitoring the threat landscape, implementing relevant countermeasures in biometric recognition systems, and monitoring and labeling security incidents.

In addition, it’s important to keep track of developments in criminal biometric presentation attacks and biometric profile extraction to assist criminal investigations.

“This information allows investigators to correctly assess any data relating to the establishment of identity assessment and access management that they encounter in their investigations,” Europol’s biometric vulnerabilities report reads.