Announcement

**Deviant Ollam** · May 16, 2006, 10:58

i'll start my comments by mentioning my utter lack of shock to learn that this is happening in the UK. it was a stroke of brilliance that george orwell set 1984 in england (or simple convenience, since he was british) since it is this nation more than any other fully-developed, fully-industrialized society that is choosing to rush headlong into a future of totalitarian control. her citizens are by far more sheep-like and accepting of draconian measures than individuals in other nations and i fear for what is going to wind up happening there. but, that is a larger discussion than this thread.

it is worth noting, for those who are exclusively familiar with american bars (or just about any non-UK establishments) that british pubs can be some of the most rough territory around. those who were present for alcohol-trivia during the BCCC event last defcon may recall one of my questions being "what objects are reported to cause more assault injuries than any other in the UK, according to <some brit medical authority>?" the answer was "pint glasses."

that said, i have almost never considered adding identity-verification mechanisms to public situations as a way to make people safer. if you want to restrict access to a records room or a gun cage... ID checks are part of your solution. public areas should never rely on ID checks since a citizen's life should be a binary matter... you either are free or you are not free.

if you are free, you should have the right to go absolutely anywhere that the public is permitted without showing any ID (granted, alcohol establishments are a slightly different matter since there are drinking ages in most developed nations... that's another rant entirely)

if someone acts like an asshat in a bar, the bar should have an appropriate measure of security (read: one or two hired goons plus members of the public who are willing to grab a drunken idiot and help throw them out) which will result in not just the asshat's expulsion but also legal processing. get arrested three or four times for brawling in a bar... wind up behind bars for a while. (the other side of the "free or not free" coin.)

if a person, once released, continues this bullshit... you toss them back in the fucking can for a longer stay. a person might continue to be a drunken jerk after they serve a nickel... but if the conviction and sentences cease to be mere bullets and they wind up doing a dime or more... i think they'll get the point.

punish those who violate the rights of others, not those who are peaceable... that is my main point. i consider it a punishment -- a reduction of freedom, to put it another way -- to fingerprint or otherwise ID track ostensibly free citizens.

**Gobniu** · May 16, 2006, 11:08

I just saw something about this on CNN and I was given the impression that giving up your fingerprint was optional howwever you did have to get your picture entered in the database. Assuming this is true then it is no worse than anything else in the U.K. (i.e. - The cameras on the streets of london)

**TheCotMan** · May 16, 2006, 11:21

I'm only one mod, and others can easily disagree with me and relocate this thread to /dev/null, but it is my opinion that it is not "too political" of a topic. There is opportunity to discuss defeating such systems (one example has been mentioned) and specific political figures and parties have not been mentioned.

Note to anyone else tuning in: don't make this political.

Discussion of laws is often tolerated-- especially when those laws border on security ,or computer security.
Discussion of features like this being offered by businesses, can be on-topic for the forums-- especially the technology being used.
Discussion of methods to defeat new systems is great example of on-topic discussion.

Calling for the removal of politicians from office is /dev/null-worthy. (Nobody has done this yet in this thread.)

If you are new to the forums, participating in this kind of thread is a risky thing, unless you have a really good idea where the line exists between "tolerated" and "off topic."

Thanks for reading!

**skroo** · May 16, 2006, 12:07

Originally posted by Virosa

1) This is only a slightly more invasive version of what Las Vegas's "Eyes in the Skies" have been doing for years. People in general don't mind those since they are inoccuous - you never see them, or at least never have them interfere with what you are doing.

No, this is much more invasive. I haven't lived in the UK since 1996, but you have to understand that it is the most-surveilled nation on the planet: at that time, CCTV cameras (bear in mind that speed cameras had already been in used for several years) were being deployed all over the country to 'curb violence'. What they actually ended up being was a surrogate for having actual, honest-to-God police on the beat; if anything, violence has gotten worse and civil liberites are suffering further - see this link for details of the system that will track a driver's movements based on automatic recognition of the vehicle's licence plate (itself a system that had been in used for many years previously at controlled entry/exit points in airport parking areas).

2) Both this example and the Las Vegas example given above are targetting "vice industries", where you can expect a higher number of patrons to overlook the temporary pain-in-the-ass factor of giving up a fingerprint for the added value of not having to dig out a wallet. (I don't seriously believe that this will curb bar fights, so I won't even list that as an added value). These people would be much less likely to discontinue their patronage of these places, and some people will draw the conclusion that people don't mind registering their prints if it saves them a few seconds.

No, what this is really doing is providing a chain of evidence in the event of someone being arrested for a violent crime: the prosecution can now track that person's movements to a location that serves alcohol. Of course, this leaves a number of questions open - was that person really drinking there, or did they just go in to use the toilet? Were they drunk before they even got there; did they cause problems while sober? This doesn't really prove anything other than that a particular person put their thumb on a reader at a specific location at a specific time; I can imagine this leading to a 'round up the usual suspects' mentality when the police run low on leads regarding an incident and can't find the persons actually responsible for <insert incident here>.

Further, are off-licences (liquor stores) going to be required to fingerprint customers purchasing alcohol for domestic consumption? All this really does is further track someone's movements and (very possibly wrongly) profile them.

3) I predict a short-term trend of acrylic press-on fingerprints (a small supply of these that correspond to a wide range of sexes/heights/builds/complexions) that are already registered with the group of bars. After these gain a little bit of notoriety, the readers will take measures to ensure that no one is wearing a prosthetic. I figure that for the first few weeks or even months, this exploit will be wide open.

Then again, there's always the old bypass of slipping the doorman a twenty.

**Virosa** · May 16, 2006, 12:14

Since this fingerprint registry appears to be set up and run by a private business, I don't think that there could be any legal problems from presenting fake IDs to the system. My initial idea for fake fingerprints would probably not keep up with a market demand, anyhow:

Bob the Dickhead is allowed into a bar with a fake fingerprint (prosthetic print from Jim the Not-a-Dickhead, who looks kinda like Bob).
Bob the Dickhead starts fight.
Bar realizes that Bob the Dickhead is aptly named, and revokes his drink ID by keying off of his fingerprint. (at this point, I am not clear on how the bar correlates an ID that was presented upon entry with the guy who started the fight - it seems like you only submit a fingerprint at the beginning of the night, not get your picture taken again.)
Jim the Not-a-Dickhead's ID no longer works, and the 15 other Dickheads that I sold copies of it to now find themselves unable to get into bars.

One thing that WOULD be pretty fun to do would be to kill people's trust in the system's accuracy. If you got a group of friends together and you all "swapped" IDs, you could complain loudly that the person who gets pulled up on the screen isn't you at all. If enough people did that, confidence in the system would be shaken. If done early enough in the product's lifecycle, it might turn people off to the idea before it gets more pervasive.

**skroo** · May 16, 2006, 12:44

Originally posted by Virosa

Since this fingerprint registry appears to be set up and run by a private business, I don't think that there could be any legal problems from presenting fake IDs to the system.

Yes, because you'll still run afoul of the laws prohibiting posession of a fake or someone else's ID, not to mention the ones also prohibiting using that ID to misrepresent your identity. Nothing will change in that regard.

Bob the Dickhead is allowed into a bar with a fake fingerprint (prosthetic print from Jim the Not-a-Dickhead, who looks kinda like Bob).
Bob the Dickhead starts fight.
Bar realizes that Bob the Dickhead is aptly named, and revokes his drink ID by keying off of his fingerprint. (at this point, I am not clear on how the bar correlates an ID that was presented upon entry with the guy who started the fight - it seems like you only submit a fingerprint at the beginning of the night, not get your picture taken again.)
Jim the Not-a-Dickhead's ID no longer works, and the 15 other Dickheads that I sold copies of it to now find themselves unable to get into bars.

Makes sense, but there's a wider-field application for this: tracking currently-unknown violations by persons currently slapped with an ASBO, or Anti-Social Behaviour Order. It's about equivalent to supervised or unsupervised probation in the US, and typically specifies places, areas, or people that the person served with it may not come into contact with; it also specifies certain types of behaviour that are forbidden.

My guess is that this is meant to be able to link people who have been served with one to violent incidents - bear in mind that the majority of the problems don't happen *in* the establishment, but rather usually after the persons in question have left it. Of course, this also punishes the majority for the behaviour of the minority, but that's a rant for an entirely other forum.

One thing that WOULD be pretty fun to do would be to kill people's trust in the system's accuracy. If you got a group of friends together and you all "swapped" IDs, you could complain loudly that the person who gets pulled up on the screen isn't you at all. If enough people did that, confidence in the system would be shaken. If done early enough in the product's lifecycle, it might turn people off to the idea before it gets more pervasive.

Until the stored prints in the system are correlated against the police database, and Bob the Dickhead's ID is associated with Jack the Twat's thumbprint. At that point it's pretty clear that someone's done something involving either a stolen ID, a swapped ID, or a hacksaw and a thumb. The latter would probably be pretty noticeable, though.

**Twigman** · May 16, 2006, 14:42

Interesting this. I have heard nothing of this and being in Southampton its not a million miles away from Yeovil...

british pubs can be some of the most rough territory around

I would have thought the US was worse! Seriously there is no pub/club I can think of that I wouldnt feel safe in. Just dont act like an ass. I would say the streets are the real issue of the problem.
Liscensed Premises have door and security staff that check id and remove unwanted people etc. They also have radios and communicate with police, and most places have posters "Barred from one, barred from them all". Once you are thrown out from somewhere, you wont get in anywhere else, at least for that night.

I have other club memberships (you show us your id, we'll take a webcam picture and your details in our computer and give you a shiny card and you'll get reduced entry discount etc). Used in a similar way to store cards collect points for things (although never implemented in my club) and when you go in you ay money and they read your card and you come up on screen. The instant problem I saw was that they used a standard webcam of the shelf and the membership stand was in the club. When the lights are going in a club and things the photo you get is not great. Easy to pretend you are someone else if you steal the card. Only thing to link it with you is a signature strip, but this is never checked/confirmed. The major thing is that its not used to confirm age/proof of ID, you will still need that to get passed door staff, it just affects the price you pay.

This obviously takes it a step further, and appears to replace ID. With this system if your ID is fake then you only have to subject it to scrutiny the first initial time, and then you are free to get in all you like after that.

The thing that really annoys me at the moment is that the only form of ID that they will accept is passports and driving liscences. We had "Identity theft protection week" last year, where the police told everyone to stop carrying all this ID around with them. At the same time the pubs and clubs had a crack down on fake ID. Going out just wasnt worth the effort.

You have to be careful where you draw the line on this matter. Personally I think the age restriction should be less strict. One day before I am 18 (in the UK) I cant enter a club/pub, the next day i can drink so much im paraletic. Silly really. I am going to stop here because its getting a bit political. I apolgise.

I think this will just computerise the current radio links and police talking to door staff etc. I cant decide whether this is a good or bad thing.

you have to understand that it is the most-surveilled nation on the planet: at that time, CCTV cameras (bear in mind that speed cameras had already been in used for several years) were being deployed all over the country to 'curb violence'. What they actually ended up being was a surrogate for having actual, honest-to-God police on the beat; if anything, violence has gotten worse and civil liberites are suffering further - see this link for details of the system that will track a driver's movements based on automatic recognition of the vehicle's licence plate (itself a system that had been in used for many years previously at controlled entry/exit points in airport parking areas).

10% of the worlds cameras are in the UK apparently. The average person living in London will be recorded on 300 cameras.
Also clubs have cameras pointing right at you as you enter pubs/clubs so that they can use it for identity later.

I have decided that this is just technology for the sake of technology without any real improvement.

**astcell** · May 16, 2006, 15:50

We can try an experiment. At Defcon we can say admission is $100 as usual, or $25 if you get your fingerprints taken. :>

**TheCotMan** · May 16, 2006, 15:58

Originally posted by astcell

We can try an experiment. At Defcon we can say admission is $100 as usual, or $25 if you get your fingerprints taken. :>

Meanwhile, outside, someone sets up a new service: "Bums Are Us"
These bums will stand in line and get you a badge for $50, or $25 in cash and $25 in cheap beer-- depending on the bum.

End results? 3000 copies of the same fingerprints, and the occasional card from a fed, human, or member of the media.

Oh yeah, and 5 to 10 drunk bums walking around near the con with inked fingers... and toes.

**renderman** · May 16, 2006, 17:09

Originally posted by TheCotMan

Meanwhile, outside, someone sets up a new service: "Bums Are Us"
These bums will stand in line and get you a badge for $50, or $25 in cash and $25 in cheap beer-- depending on the bum.

End results? 3000 copies of the same fingerprints, and the occasional card from a fed, human, or member of the media.

Oh yeah, and 5 to 10 drunk bums walking around near the con with inked fingers... and toes.

Or just give me $10 for a plastic finger with Chris's fingerprint :)

**TheCotMan** · May 16, 2006, 17:57

Originally posted by renderman

Or just give me $10 for a plastic finger with Chris's fingerprint :)

This brings up an interesting point. Finger prints might be used as, "secrets," but what happens when the value of a fingerprint increases, and is used at part of an authentication system? What happens when thousands of copies of any one person's prints are sold like credit card numbers? High resolution imaging is availbale for duplication of fingerprints, and techniques to replicate fingerprints have been produced over time to allow for false positives.

There was the "Gummi Bear" attack (part 1) that relied upon the oils of a previous print left on the scanner to be re-used with a Gummi Bear.

And the was the plastic molds, gelatin, PCB attack with Gummi Bears and other material

Discussions and testing of PlayDough wax, frozen with wax paper

If readily available, the effectiveness of fingerprints as evidence a person had touched an item is diminished Extra scans with DNA with dead skin, oils, and other evidence would be needed in parity with any fingerprint evidence, or reasonable doubt might exist. It could become an advantage for criminals to share their prints, and pollute the use of that as evidence in any future cases. "No. I was not there killing someone, I was at the bar! Check my alabai!" Why not? If it only grants access to buy beer?

If the fingerprint is only used to verify "registered users" and does not grant access to the owner's resources, (like money, credit, property,) what interest is it to the individual to not share their fingerprints with others?

**Deviant Ollam** · May 16, 2006, 20:08

Originally posted by TheCotMan

drunk bums walking around near the con with inked fingers

as far as i know, the ink wheel system is being phased out in areas where the municipal budgets are good enough to get newer equipment. the most recent time i was printed it was on a large scanner-bed type device which had a touchscreen and video display of the whorls and arches as they were being read (so the officer could instantly process a re-scan of a particular digit if necessary). a far cry different from the old system... no walking away with inky fingers anymore.

**Nikita** · May 19, 2006, 17:49

Just wanted to contribute my thoughts as well, i liked reading this thread.

With easy to get/purchase fingerprints,( ideas already pointed out) there are plenty of new ways to minipulate, mine and covet data. A determined citizen can stalk, frame or worse. Always have been always will be. But as the public becomes more and more accepting of this and makes themselves more transparent then it certainly contributes a lot more ammo to the pile.

I know you can determine my train of thought here:

With everything so readily available what will happen if someone with the brain power combines and exploits all 3 of these clear violations of privacy into one
"Import feed-Local or remote, Search copy, demonize" application. What does our future have in store for us,if this tech put into use by the legal/commerce systems progresses, how much will this increase false positives in crimal convictions? Will science fiction be our moral cliff notes here?

Announcement

Fingerprints required for Bars in the UK

Fingerprints required for Bars in the UK

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment