by Eoin Higgins, Activist Post:
One of the key fears that critics of mass surveillance and the proliferation of facial recognition technology have warned about has been realized with new reporting Monday that a “malicious cyber attack” has resulted in photos of airport passengers and other personal data harvested by U.S. Customs and Border Patrol being stolen by unknown actors.
According to the Washington Post:
Customs officials said in a statement Monday that the images, which included photos of people’s license plates, had been compromised as part of an attack on a federal subcontractor.
The agency maintains a database including passport and visa photos that is used at airports as part of an agency facial-recognition program. CBP declined to say what images were stolen or how many people were affected.
But CBP makes extensive use of cameras and video recordings at the arrival halls of international airports as well as land border crossings, where vehicle license plates are also captured.
A CBP statement said none of the image data had been identified “on the Dark Web or Internet.” But reporters at The Register, a British technology news site, reported late last month that a large haul of breached data from the firm Perceptics was being offered as a free download on the dark web.
The CBP apparently did not want to confirm which private subcontractor was the target of the attack, but the Post and others were able to track down that it likely was Perceptics:
— Lindsey Barrett (@LAM_Barrett) 10 June 2019
“This is a bombshell,” said Evan Greer, deputy director of the advocacy group Fight fight for the Future, in response to the reporting. “Even if you 100% trust the US government with your biometric information (which you shouldn’t) this is a reminder that once your face is scanned and stored in a database, it’s easily shared across government agencies, stolen by hackers, other governments, etc.”
BuzzFeed, also among the first to report on the breach on Monday, noted that the “cyberattack comes amid the ongoing rollout of CBP’s “biometric entry-exit system,” the government initiative to biometrically verify the identities of all travelers crossing US borders.” As BuzzFeed News reported Citing earlier reporting, BuzzFeed pointed out that “CBP is scrambling to implement the initiative with the goal of using facial recognition technology on ‘100 percent of all international passengers,’ including American citizens, in the top 20 US airports by 2021.”
This breach comes just as CBP seeks to expand its massive face recognition apparatus and collection of sensitive information from travelers, including license plate information and social media identifiers. https://t.co/qUvOE8UQY2
— ACLU (@ACLU) 10 June 2019
In a statement, Neema Singh Guliani, senior legislative counsel at the ACLU, said the compromise of passenger data is a great example of why privacy and civil liberties groups continue to warn about facial recognition and the electronic collection of other personal data.
“This breach comes just as CBP seeks to expand its massive face recognition apparatus and collection of sensitive information from travelers, including license plate information and social media identifiers,” said Guliani. “This incident further underscores the need to put the brakes on these efforts and for Congress to investigate the agency’s data practices. The best way to avoid breaches of sensitive personal data is not to collect and retain it in the first place.”