Biometrics is being transferred to a simplified version – Newspaper Kommersant No. 218 (7419) dated 11/24/2022

Bankers have come up with a proposal to reduce the security requirements for equipment and devices used in biometric client authentication. Otherwise, according to market participants, it is impossible to comply with the norms that come into force from March 2023 “for lack of appropriate technical solutions.” If banks are unable to provide the necessary level of protection, payment and passage “on the face” will become impossible until the availability of suitable equipment in terms of quality and price.

At the meeting of the Ministry of Digital Development, the Central Bank and banks held at the beginning of the week on the regulation and use of biometrics, the latter proposed to reduce the security requirements for the equipment used for authentication established in government decree #1815 of October 23, 2021 in cases where the collected data are in the banks’ own databases. This was told by two sources of Kommersant, who are familiar with the course of the discussion.

The proposal does not apply to biometrics collection devices, it is only about the requirements for the technology used to authenticate existing bank customers – mobile phones, biometric payment terminals, various access control systems (in particular, subway turnstiles). The issue of lowering the requirements should be worked out by the Central Bank together with the Ministry of Digital Development, Kommersant’s interlocutors say.

According to a Kommersant source in one of the major banks, the main question that was asked to the meeting participants was how ready banks are to comply with security requirements. Banks were skeptical about the prospects for this and announced the need to reduce the norms “in order to be able to implement them.” In particular, we are talking about replacing the protection class stage KS 2 (provided by hardware and software) to KS 1 (provided by software).

A higher level of protection makes it possible to ensure that there are no virus bookmarks or undocumented programs during the operation of the end device, a Kommersant source in the biometrics market explains. But the problem is that there are practically no devices that would meet the requirements of COP 2, Kommersant sources say, with the exception of, for example, a tablet on the Aurora OS.

The requirements come into force from March 2023. And if banks have to comply with them next year, in fact, market participants will not be able to use biometrics. According to the participants of the meeting, the terms of development of such solutions can stretch for 1.5-2.5 years. The Central Bank and the Ministry of Digital Development did not answer “Kommersant”.

As Alexander Naumov, deputy head of the NSFR, notes, “the problem is that due to the limited possibilities for obtaining components for various devices, the possibilities to comply with KS 2 are technologically very limited.” According to him, it is now very difficult to provide the necessary amount of equipment on the market that would correspond to the declared level of safety, “if not worse, it is impossible.”

There are very few companies in Russia that can produce equipment that meets the stated level of the standard, says Alexander Naumov. Therefore, banks are asking for the opportunity to use the equipment that corresponds to a lower protection class, “it is more affordable, including in terms of money and quantity.”

Sources of Kommersant consider it necessary to “make a difficult decision”, including suspending the project with biometrics, since in many respects it becomes unrealizable. “If biometrics is too expensive to use, banks will look for other ways,” emphasizes the interlocutor of Kommersant in a large bank.

Alexander Naumov also believes that it is possible to “introduce relaxations, for example, reduce the requirements for cryptographic protection, until there is sufficient domestic equipment corresponding to class KS 2.” At the same time, the expert admits, the downside of such a decision will inevitably be an increase in fraud.

Olga Sherunkova