Info-tech

The Taliban reportedly have control of US biometric devices

PTI Pennsylvania (US) | Updated on August 31, 2021

It’s a lesson in life-and-death consequences of data privacy

In the wake of the Taliban’s takeover of Kabul and the ouster of the Afghan national government, alarming reports indicate that the insurgents could potentially access biometric data collected by the US to track Afghans, including people who worked for US and coalition forces.

Afghans who once supported the US have been attempting to hide or destroy physical and digital evidence of their identities. Many Afghans fear that the identity documents and databases storing personally identifiable data could be transformed into death warrants in the hands of the Taliban.

This potential data breach underscores that data protection in zones of conflict, especially biometric data and databases that connect online activity to physical locations, can be a matter of life and death. My research and the work of journalists and privacy advocates who study biometric cyber surveillance anticipated these data privacy and security risks.

Biometric-driven warfare

Biometric-driven warfare Investigative journalist Annie Jacobson documented the birth of biometric-driven warfare in Afghanistan following the terrorist attacks on September 11, 2001, in her book First Platoon. The Department of Defence quickly viewed biometric data and what it called “identity dominance” as the cornerstone of multiple counterterrorism and counterinsurgency strategies. Identity dominance means being able to keep track of people the military considers a potential threat regardless of aliases, and ultimately denying organisations the ability to use anonymity to hide their activities.

Tech companies pledge billions in cybersecurity investments

By 2004, thousands of US military personnel had been trained to collect biometric data to support the wars in Afghanistan and Iraq.

By 2007, US forces were collecting biometric data primarily through mobile devices such as the Biometric Automated Toolset (BAT) and Handheld Interagency Identity Detection Equipment (HIIDE). BAT includes a laptop, fingerprint reader, iris scanner and camera. HIIDE is a single small device that incorporates a fingerprint reader, iris scanner and camera. Users of these devices can collect iris and fingerprint scans and facial photos, and match them to entries in military databases and biometric watchlists.

In addition to biometric data, the system includes biographic and contextual data such as criminal and terrorist watchlist records, enabling users to determine if an individual is flagged in the system as a suspect. Intelligence analysts can also use the system to monitor people’s movements and activities by tracking biometric data recorded by troops in the field.

By 2011, a decade after 9/11, the Department of Defence maintained approximately 4.8 million biometric records of people in Afghanistan and Iraq, with about 630,000 of the records collected using HIIDE devices. Also by that time, the US Army and its military partners in the Afghan government were using biometric-enabled intelligence or biometric cyberintelligence on the battlefield to identify and track insurgents.

In 2013, the US Army and Marine Corps used the Biometric Enrolment and Screening Device, which enrolled the iris scans, fingerprints and digital face photos of “persons of interest” in Afghanistan. That device was replaced by the Identity Dominance System-Marine Corps in 2017, which uses a laptop with biometric data collection sensors, known as the Secure Electronic Enrolment Kit.

Policing cyberspace

Over the years, to support these military objectives, the Department of Defence aimed to create a biometric database on 80 per cent of the Afghan population, approximately 32 million people at today’s population level. It is unclear how close the military came to this goal.

More data equals more people at risk

In addition to the use of biometric data by the US and Afghan military for security purposes, the Department of Defence and the Afghan government eventually adopted the technologies for a range of day-to-day governmental uses. These included evidence for criminal prosecution, clearing Afghan workers for employment and election security.

In addition, the Afghan National ID system and voter registration databases contained sensitive data, including ethnicity data. The Afghan ID, the e-Tazkira, is an electronic identification document that includes biometric data, which increases the privacy risks posed by Taliban access to the National ID system.

Watch | Fake oximeter apps are stealing biometric data from users: TN Police Dept

It’s too soon after the Taliban’s return to power to know whether and to what extent the Taliban will be able to commandeer the biometric data once held by the US military. One report suggested that the Taliban may not be able to access the biometric data collected through HIIDE because they lack the technical capacity to do so. However, it’s possible the Taliban could turn to long-time ally Inter-Services Intelligence, Pakistan’s intelligence agency, for help getting at the data. Like many national intelligence services, ISI likely has the necessary technology.

Another report indicated that the Taliban have already started to deploy a “biometrics machine” to conduct “house-to-house inspections” to identify former Afghan officials and security forces. This is consistent with prior Afghan news reports that described the Taliban subjecting bus passengers to biometric screening and using biometric data to target Afghan security forces for kidnapping and assassination.

Concerns about collecting biometric data

For years following 9/11, researchers, activists and policymakers raised concerns that the mass collection, storage and analysis of sensitive biometric data posed dangers to privacy rights and human rights. Reports of the Taliban potentially accessing US biometric data stored by the military show that those concerns were not unfounded. They reveal potential cybersecurity vulnerabilities in the US military’s biometric systems. In particular, the situation raises questions about the security of the mobile biometric data collection devices used in Afghanistan.

The data privacy and cybersecurity concerns surrounding Taliban access to US and former Afghan government databases are a warning for the future. In building biometric-driven warfare technologies and protocols, it appears that the US Department of Defence assumed the Afghan government would have the minimum level of stability needed to protect the data.

The US military should assume that any sensitive data — biometric and biographical data, wiretap data and communications, geolocation data, government records — could potentially fall into enemy hands. In addition to building robust security to protect against unauthorised access, the Pentagon should use this as an opportunity to question whether it was necessary to collect the biometric data in the first instance.

Understanding the unintended consequences of the US experiment in biometric-driven warfare and biometric cyber intelligence is critically important for determining whether and how the military should collect biometric information. In the case of Afghanistan, the biometric data that the US military and the Afghan government had been using to track the Taliban could one day soon — if it’s not already — be used by the Taliban to track Afghans who supported the US. (The Conversation) By Margaret Hu, Penn State, Pennsylvania

Published on August 31, 2021

Follow us on Telegram, Facebook, Twitter, Instagram, YouTube and Linkedin. You can also download our Android App or IOS App.

This article is closed for comments.
Please Email the Editor

You May Also Like