Appreciate this article? +972 depends on your support -- click here to help us keep going

Analysis News

Pilot begins for Israel's National Biometric Database program

New database will allow immediate access by security forces, without court order, to the face scan and finger prints of every Israeli.

A machine for the collection biometric information at an Israeli Interior Ministry branch in Haifa (photo: michtzi1)

After several delays, the Interior Ministry on Monday will commence the two-year pilot stage of Israel’s National Biometric Database Program. When completed, the database will include the biometric information – a face scan and fingerprints – of all Israeli citizens, accessible without court order to the police and security forces, including the army, the military police and the Shin Bet (Israel Security Agency). In addition, a court could also order the transfer of individual biometric information, and even the entire database, to other agencies and even to foreign bodies.

The database was an initiative of the security forces. The legislative effort, which was led my MK Meir Shitrit from Tzipi Livni’s Tnua party, was met with heavy criticism from the opposition and human rights groups, that warned of possible abuses of the power the database puts in the hands of authorities and of leaks that could see the information end up in the wrong hands. Most of the Interior Ministry’s current registration of Israeli citizens has already leaked to the Internet.

The government claimed that the database is needed in order to prevent the forging of Israeli ID cards and passports. However, critics point to the fact that the government could issue “Smart IDs,” which themselves store biometric data, without keeping the personal records in one national database.

>  Opinion: The new biometric database is a threat to the privacy and freedom of every Israeli / Atty. Jonathan J. Klinger

Due to public criticism, the plan to force all citizens to submit their biometric information and receive new identity cards was replaced with a two-year pilot, in which the public’s reaction and the database’s security will be tested. During that time, Israelis who seek to renew their ID or Passport will be offered to submit their biometric information and receive the new “Smart IDs.” Hewlett-Packard was the contractor chosen to provide the hardware for the program.

Former Minister Micky Eitan (Likud) has called the public to refuse the pilot. The Association for Civil Rights in Israel and several members of Knesset also called on citizens not to give their biometric information to the authorities.

In the margins of the national controversy over the database, an embarrassing incident occurred to Finance Minister Yair Lapid last month. Lapid was asked on a Facebook chat with supporters why he changed his views on the database (from opposing to supporting it). In response, he asked the person who posted the question “to take a flashlight” and begin searching for “a single statement” in which Lapid said something against the database. Soon after, several people posted a Q&A from the latest campaign in which the Yesh Atid party opposed the database.

Yesh Atid is part of the coalition which now backs the database.

Related:
New Israeli ID card numbers to begin at 6 million

For additional original analysis and breaking news, visit +972 Magazine's Facebook page or follow us on Twitter. Our newsletter features a comprehensive round-up of the week's events. Sign up here.

View article: AAA
Share article
Print article
  • COMMENTS

    1. The Trespasser

      After years of debates, it is still rather unclear how exactly would the biometric database infringe privacy of Israelis.

      Not that I’m gonna recieve such ID anytime soon – probably I’d be the last one to do so.

      The only realistic concern so far IMO is that the database, including face scans (what are face scans exactly, by the way? Digital photo image? 3D map of face?) and fingerprints might be leaked, as were leaked databases of Ministry of Interior, which included ID numbres, addresses, telephone numbers and few more fields.

      >However, critics point to the fact that the government could issue “Smart IDs,” which themselves store biometric data, without keeping the personal records in one national database.

      Biometric passports without a database to check against would be rather useless since it is not possible to prevent changes to the contents of the chip.

      >accessible without court order to the police and security forces, including the army, the military police and the Shin Bet (Israel Security Agency)

      As far as I know, security forces never needed a court order to have access to fingerprints or ID picture of a suspect.

      >a court could also order the transfer of individual biometric information, and even the entire database, to other agencies and even to foreign bodies.

      As far as I know, EU and USA have a similar kind of agreement.

      http://en.wikipedia.org/wiki/Biometrics
      http://en.wikipedia.org/wiki/Countries_applying_biometrics
      https://en.wikipedia.org/wiki/Biometric_passport

      Reply to Comment
      • Vadim

        You are wrong regarding Smart IDs.
        Having your data stored on a chip and signed using cryptography would make forgeries *extremely* difficult. Not only would you have to bypass the digital signatures, but the relevant chips have tamper-proofing technologies as well.

        There is no need for a central database to verify the cards. You biometrics would be compared to the ones stored on your ID.

        Cryptography can provide solutions to the database issues as well. I really find it puzzling that they intend to store the data as is. Why not only store the hash of the biometrics? Given fingerprints, security forces would still be able ti find out who they belong to, but there would be nothing to steal… (or to be more precise, having the database stolen is still a very far from being able to somehow use it)

        Reply to Comment
        • Kolumn9

          It is not trivial to hash finger-prints or other biometric information. They are somewhat fuzzy as are the algorithms for matching them. Storing only hashes on the server wouldn’t be very useful for the security forces. In any case, they wouldn’t want to store hashes because they want the actual data.

          If you just want to prevent forgeries you don’t even need to use biometric information. You can take tz numbers, names, birthdays, addresses, encrypt and sign them on chip.That alone will prevent the vast majority of forgeries.

          Most likely there is a real problem with forgeries and the security services are free-riding on the legislation to collect a vast database of biometric data.

          Reply to Comment
          • Vadim

            Nothing is trivial.

            Given fingerprints, security forces need to find out who they belong to. This is possible if one-way functions are used to store the fingerprints. I don’t see a legitimate reason for them needing the fingerprints themselves.

            Besides reducing forgeries, storing biometrics on the ID will also allow to verify that the holder is indeed the owner of the ID card.

            Reply to Comment
          • Kolumn9

            When I say that it is not trivial what I mean is that storing the result of one way functions is insufficient for matches for fingerprints or photos. Algorithms for finger print and photo recognition function on the basis of fuzzy matching because there is variation and changes in appearance (even of fingerprints and definitely of fingerprint scans) over time. Algorithms are not at the point yet of being able to store a signature/hash/whatever of a photo or a fingerprint and use that for matching, so they would not be useful to authorities for this purpose.

            Reply to Comment
      • Vadim

        “Cryptography is only as good as its implementation”

        Agree.

        But authentication still doesn’t require to hold a DB of everything.

        Reply to Comment
        • The Trespasser

          >But authentication still doesn’t require to hold a DB of everything.

          Hmmm… Hashes stored in DB checked against hashes of image stored in the chip (calculated each time when authentication is required; should be equal) which image is checked against scanned image of the person, should be secure enough, if implemented properly. Basically it would look like {DB [hash] [hash] Chip [data] [data] Scan}
          If any check fails, access should be denied.
          However, if the scan is faulty for some reason, access would be denied as well, while it is also (theoretically) possible to compromise {DB [hash] [hash] Chip} part by preparing chip so it would send needed hash instead of real one.

          Having real data stored in both chip and DB and checking scanned image against both would make forgery whole magnitude more complicated – I can only think of some serious MiM attack on scanning device which would help compromising the authentication procedure.

          Reply to Comment
    2. Danny

      All Israelis should refuse to give their biometric information to the state. If the state insists, and makes the issuance of passports and ID cards conditional on the surrender of one’s biometric information, then the individual should consider giving up their Israeli citizenship (I already have!)

      Your bio information is YOURS, don’t give it to Israel to use and abuse as they see fit!!!

      Reply to Comment
      • The Trespasser

        >Your bio information is YOURS, don’t give it to Israel to use and abuse as they see fit!!!

        It would be highly interesting to learn how exactly a state could use (or abuse) biometric data of its citizens.

        Reply to Comment
    3. Philos

      Noam, you committed a non-sequitur. By handing ones biometric data over to the authorities one has already passed it on to the “wrong hands.” If its leaked its some other pair of hands that may or may not be wrong :)

      Reply to Comment
    4. I would say that the poor record of equal protection within the Israeli judiciary is reason enough to refuse this program. The only present clear check on the government is what it says it will and will not do, and this is never enough.

      Reply to Comment

    LEAVE A COMMENT

    Name (Required)
    Mail (Required)
    Website
    Free text

© 2010 - 2014 +972 Magazine
Follow Us
Credits

+972 is an independent, blog-based web magazine. It was launched in August 2010, resulting from a merger of a number of popular English-language blogs dealing with life and politics in Israel and Palestine.

Website empowered by RSVP

Illustrations: Eran Mendel