Federal Photos Filched in Contractor Breach

[steven36]

Data should never have been on subcontractor's servers, says Customs and Border Protection.

 

 

Photos used by US Customs and Border Protection (CBP) in an effort to protect travelers have been taken in an attack against a federal subcontractor. Officials confirmed the compromise, which they described as part of a malicious cyberattack.

While the agency declined to give details about the photos accessed by the attacker, the subcontractor is known to maintain databases of photos that include passport and visa photos, license plate images, and images from facial recognition systems.

 

According to the agency, a subcontractor transferred CBP data to its network, which was subsequently hacked. "The issue with subcontractors is that you can't completely control how they secure their network," says Pierluigi Stella, CTO of Network Box USA. "You can ask for certifications, financials, controls, and attestations, but there is always a limit to how much you can demand."

 

In its statement announcing the breach, CBP said it has " ... removed from service all equipment related to the breach and is closely monitoring all CBP work by the subcontractor."

 

The breach comes as CBP is increasing its use of facial recognition and other image-based security. "This incident further underscores the need to put the brakes on these efforts and for Congress to investigate the agency’s data practices," said Neema Singh Guliani, a lawyer for the American Civil Liberties Union, in a statement. "The best way to avoid breaches of sensitive personal data is not to collect and retain such data in the first place."

 

Read more here.

 

Source

[steven36]

'This Is a Bombshell': Facial Recognition Data Collected by US Customs Agency Hacked

 

 

"Even if you 100% trust the US government with your biometric information (which you shouldn't) this is a reminder that once your face is scanned and stored in a database, it's easily shared across government agencies, stolen by hackers, other governments, etc."

 

One of the key fears that critics of mass surveillance and the proliferation of facial recognition technology have warned about has been realized with new reporting Monday that a "malicious cyber attack" has resulted in photos of airport passengers and other personal data harvested by U.S. Customs and Border Patrol being stolen by unknown actors.

 

"This incident further underscores the need to put the brakes on these efforts and for Congress to investigate the agency's data practices. The best way to avoid breaches of sensitive personal data is not to collect and retain it in the first place."
—Neema Singh Guliani, ACLU

 

According to the Washington Post:

 

Customs officials said in a statement Monday that the images, which included photos of people’s license plates, had been compromised as part of an attack on a federal subcontractor.

The agency maintains a database including passport and visa photos that is used at airports as part of an agency facial-recognition program. CBP declined to say what images were stolen or how many people were affected.

 

But CBP makes extensive use of cameras and video recordings at the arrival halls of international airports as well as land border crossings, where vehicle license plates are also captured.

 

A CBP statement said none of the image data had been identified "on the Dark Web or Internet." But reporters at The Register, a British technology news site, reported late last month that a large haul of breached data from the firm Perceptics was being offered as a free download on the dark web.

The CBP apparently did not want to confirm which private subcontractor was the target of the attack, but the Post and others were able to track down that it likely was Perceptics:

lol these dummies https://t.co/P3SJ0Jk8tN pic.twitter.com/GZs0Su3w8b

— Lindsey Barrett (@LAM_Barrett) June 10, 2019

"This is a bombshell," said Evan Greer, deputy director of the advocacy group Fight fight for the Future, in response to the reporting. "Even if you 100% trust the US government with your biometric information (which you shouldn't) this is a reminder that once your face is scanned and stored in a database, it's easily shared across government agencies, stolen by hackers, other governments, etc."

 

Buzzfeed, also among the first to report on the breach on Monday, noted that the "cyberattack comes amid the ongoing rollout of CBP's "biometric entry-exit system," the government initiative to biometrically verify the identities of all travelers crossing US borders." As BuzzFeed News reported Citing earlier reporting, Buzzfeed pointed out that "CBP is scrambling to implement the initiative with the goal of using facial recognition technology on '100 percent of all international passengers,' including American citizens, in the top 20 US airports by 2021."

This breach comes just as CBP seeks to expand its massive face recognition apparatus and collection of sensitive information from travelers, including license plate information and social media identifiers. https://t.co/qUvOE8UQY2

— ACLU (@ACLU) June 10, 2019

In a statement, Neema Singh Guliani, senior legislative counsel at the ACLU, said the compromise of passenger data is a great example of why privacy and civil liberties groups continue to warn about facial recognition and the electronic collection of other personal data.

 

"This breach comes just as CBP seeks to expand its massive face recognition apparatus and collection of sensitive information from travelers, including license plate information and social media identifiers," said Guliani. "This incident further underscores the need to put the brakes on these efforts and for Congress to investigate the agency's data practices. The best way to avoid breaches of sensitive personal data is not to collect and retain it in the first place."

 

In a total surprise that absolutely nobody could have predicted, the federal gov'ts new facial-recognition database is breached, just months after deployment:https://t.co/huyyjBhXZY

 

Backstory from a good Buzzfeed piece:https://t.co/sqpT3AfSpS

— Charles C. Mann (@CharlesCMann) June 10, 2019

In an opinion piece ironically posted at the Washington Post just hours before the news story broke—titled "Don't smile for surveillance: Why airport face scans are a privacy trap"— columnist Geoffrey A. Fowler warned that even as U.S. consumers become more accustomed to facial recognition technology—such as using your face to unlock an iPhone or other device—what happens when a government agency or airline captures such an image at the airport is something entirely different.

 

"When you unlock an iPhone, your face scans never go to Apple or even leave your phone," explains Fowler. "But at an e-gate, your face gets captured by the airline and then compared with a face database run by U.S. Customs and Border Protection, which reports back whether you're cleared to board."

 

The big difference, however, is that there needs to be some cross-verification of any face the system at the airport is trying to match. "Where do those come from?" writes Fowler. "From the State Department, which gathers the shots from passports and visa applications."

 

Source