Cybersecurity expert called the risks of collecting biometrics of Russians

He called the most secure data collection options

Vladimir Putin signed the law on biometrics on Thursday. The document, which caused a flurry of controversy and criticism at the development stage, turned out to be more than soft at the end. First, there will be no forced collection of biometric Russians by law. Secondly, no discrimination against “refuseniks”. But experts in the IT industry still found the risks that a system for collecting data with the faces and voice samples of Russian citizens may pose.

While still a bill, the unified biometric data system has undergone major revisions. According to the head of the State Duma Committee on Information Policy Alexander Khinshtein, the document was almost completely rewritten by the second reading. The bill introduced a rule according to which the collection of biometric data should be strictly voluntary. You can opt out of data collection at any time. Moreover, it is possible to revoke previously given consent. This can be done through the portal of public services or the MFC. All these rules are now fixed in the law, which was signed by Vladimir Putin on December 29.

In addition, the law introduces a ban on the storage of genomic information. As for biometrics, the state database will contain samples of Russian voices and images of faces. Another restriction concerns children: you cannot use the biometrics of minors without parental permission. The ban is also imposed on the transfer of biometric data abroad.

A specially created Coordinating Council for the Development of Digital Identification and Authentication Technologies Based on Biometrics will control the operation of the unified biometric system (UBS). This body will include representatives of the public, religious organizations and experts.

Earlier, Alexander Khinshtein emphasized that there is no need to worry about the security of biometric data that gets into the EBS. The deputy noted that now there are more than 70 million samples of biometrics of Russian citizens in circulation. They are stored in scattered databases of banking structures, management companies in the housing and communal services sector, and even fitness clubs. The new state system will be highly protected with the help of encryption protocols, the parliamentarian assured.

Meanwhile, there are still certain risks in the system for collecting and storing biometrics, – Andrey Masalovich, an expert on cybersecurity, admits:

– Initially, a set of biometric data was incorrectly selected. The face and voice fall immediately to an unidentified circle of people. If you went to the subway and paid with your face or passed under a surveillance camera, your image can already be used, intruders can take advantage of this, the expert complained.

As Masalovich explained, a more reliable biometric option would be a palm scan:

– The palm can be counted from 30 meters. If you need to pay in a store using biometrics, you waved your hand at the cashier. And when you don’t need to use your biometrics, you just put your hand in your pocket or clenched your palm into a fist. It doesn’t work that way with a face. Face identification is a priori cross-border.

The expert named another option that would reliably protect the data of citizens who agreed to the collection of biometrics:

– So-called intermediate labels can be used to protect data. For example, at the World Cup in Qatar, fans were given personal cards on which their data was recorded. These cards were used to verify the person’s identity. But it was impossible to use the data, – Andrey Masalovich explained.