Tuesday, October 25, 2011

Israel Data Breach: What You Talkin' 'bout, Fast Company?

The theft of the Israeli Welfare Ministry database is being used by opponents of biometric population registers to bring attention to the potential dangers of centralized Identity Management data repositories.

This is entirely appropriate and a good thing.

Opponents of the use of biometric technologies are entitled to their point of view and entitled (even obligated) to argue for their vision of the proper use of the technology. Only by forthright and truthful dialogue can democratic societies reach consensus on matters of great importance to the fundamental rights of the individual, among which is the right to privacy.

Unfortunately, a forthright and truthful dialogue on this subject is not to be had by the readers of Fast Company in The Dark Side Of Biometrics: 9 Million Israelis' Hacked Info Hits The Web

Read carefully, the article asserts (twice!) that biometric information was stolen, though it offers no support for the assertion.
According to the ultra-Orthodox Jewish Yeshiva World News, the stolen biometric database was passed around by six separate suspects, who made copies of the records in exchange for cash.

Identity theft and petty Internet crimes being what they are, the stolen biometric information quickly made its way online. One of the secondary suspects uploaded the whole of Israel's biometric records database to the Internet under the name “Agron 2006.” A quick Google search reveals numerous torrents and uploaded copies of the database easily available for download. [bold emphasis mine, links in the original]
The story behind each link provided actually undermines the assertion made in the text of the link itself.

Click the Yeshiva World News link, the one that says "stolen biometric database", and you find absolutely no mention of an actual stolen biometric database. You will find, however, that...
The opponents to such a national database are using this latest incident to warn that if a biometric database was ever broken, the results would be far more catastrophic... In actuality, Israel is lagging behind.
There's plenty of mention of outdated identity documents, though.

Click the link that says "uploaded the whole of Israel's biometric records database" and you'll be directed to an article in which the word "biometric" does not appear at all, but you will find that...
The information included Israeli citizens' names, identification numbers, addresses, birthdates and other important dates as well as relationships between various citizens. 
This is extremely sloppy reporting at best. Whatever else it is, it is certainly counterproductive to any meaningful debate about the proper use of biometric identity management technologies.

What's going on here?