you're watching news from berlin up next doc film looks at the criminal trade in biometric data more news coming up at the top of the hour and of course don't forget you can always check out our website do you hear dot com probably i'm my ass waiter thank you so much for joining us. so if you have to get through the bin disney get break without a simple thanks again. and. please thanks. emotion. some. big swings in 90. 2 goals the results on d.w.p. .

biometric features like the iris or fingerprints are unique and can't be changed. that's why they are used to provide secure protection for passports mobile phones and bank account. book these features are easily accessible we leave fingerprints every time we touch something so our biometric feature is really secure after all they're often used to protect some of our most sensitive data. to i.d. companies and government agencies do a proper job of protecting biometric data from cyber attacks or are the criminals one step ahead. what happens when that data falls into the wrong hands.

a growing number of people are using biometric data to access digital devices like mobile phones. the data are easy to use and you can't forget that as you might a password. but most people don't realize that when they access their devices they leave a data trail. reminds how do you unlock your phone which in fact my finger fingerprint is the phase a fingerprint it's safer and i think it's safer if i use a the phone they figure a pretty good friend fellman even when they figure enough the pin number. c.z. are in faster years so it's all use touch id. we're at munich airport to meet i.t.

security specialist going up parata. governments and private sector companies often make use of his expertise for example if their systems have been hacked. do we place too much trust in the security of biometric data. given this data is not secure and it's vulnerable to attack. we usually have no idea where and how our biometric data are stored sometimes this information is encrypted sometimes not. did it can also be stored on the device that we're using or in an app or in a cloud. litigious is going to it's certainly convenient to just use a fingerprint to unlock a digital device the system works well to do until the data falls into the wrong hands this is new technology and we don't have a lot of experience using it. if something goes wrong. it's often too late to fix

it and this is shawn suspects. this is how the biometric fingerprint authentication process usually works the image is evaluated converted into digital form and then stored in a database and when you try to access the device with a fingerprint it's compared with the image in the database if it matches your in. if it doesn't access is denied but how secure are these systems. to find out more we've arranged to meet a berlin hacker who calls himself star bug. last year he showed us how easy it is to forge a fingerprint. we meet up with the chaos computer club

a german hacker association where starbuck wants to demonstrate a biometric fingerprint hack it involves us swapping fingerprints. starbucks fingerprint on the phone screen is scanned in. editors on the computer and then printed out on transparent film. the printer is then smeared with regular glue to create a mold. is it really very easy to outsmart a high tech scanner. 2 hours later when the glue is dry with the lid off. after breathing on it briefly we attach starbucks fingerprint to our reporter's finger. alone behold the scanner says user identified. and starbuck is in red or we are. using

a simple glue mold to trick the scanner. thing up we were working with the only detection device that was certified in germany for that purpose the company claimed that the device could distinguish between a fingerprint mockup on the real thing. and so we used a fake fingerprint and the device couldn't tell the difference for an associate a couple coming up on it and then for us that's definitely cause for concern today we want to find out whether there are similar problems with security systems that are based on the iris of the human eye. we take a photograph of starbucks iris ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah ah. ah.

he loads the digital image onto his computer and it just it to the correct proportions. to. the next step is to print the resized image. and then. we'll switch the security settings on his phone to iris detection. as this should allow me to unlock the phone with an image of my iris. access codes to enter and is it secure since the manufacturer says it is but will soon see that it's normal to some innocent as. we bought some generic contact lenses at a drugstore will help to make the iris image more realistic. ringback

told them so take the image and hold it up and give us a turn it on. and on you know we're in. unbelievable. high tech security system is outsmarted by a simple piece of paper. cyber attacks on individuals are bad enough but it's even worse when criminals hack into databases where extensive numbers of such images are stored. today might involve just one person criminals can just select a victim of data and in those databases there are files and even hundreds of thousands of high quality fingerprint images. you don't have to waste time fixing them up. because.

biometric data is widely available on a part of the internet that can only be accessed by means of special software. it's a virtual meeting marketplace for criminals to. hide their identity behind pseudonyms and encryption systems. millions of personal data records are offered for sale on the web. we've managed to track down some sites used by the identity theft mafia. covered was all kinds of data stolen from people all over the world. including names addresses credit card information and bank account details. that we did

a search using for search term biometric and found people were offering guides for forging fingerprints. and replica fingerprints used to fool security systems we have no idea who this fingerprint actually belongs to. we also saw numerous offers for illegal travel document. either complete forgeries or stolen ideas that have been tampered with. sports for most countries where on offer including germany. biometric passports are also available like this one from the us. we contacted one of the sellers. i need an e.u. passport with biometric features can you get me one. how

much one can you deliver. for their reply. even the theft of conventional data can become a huge problem for those targeted. data were stolen the social media. company then. $1000.00 euros for electronic goods. she initially ignored the demand for payment. but just a few days later she received a further demand this time from a debt collecting agency. not again. yeah look i'm calling about a letter telling me that i had ordered something except i didn't. start home in

hope but yes i misses her but that's not me 9 already spinning this convention issued a 1000 it became several 1000 euros in total one invoice for 300 euros another for 700 and then a 1000. to me in the mail kept on piling up 3 or 4 letters a week but he failed. over in school some eventually the bill was over 13000 euros then i thought you have to take action or something are discovered to handle it i'd like to file a complaint. as i did. despite being the victim the onus was on her to convince the police that somebody had been shopping using her name if it's not to be thinking through grief what we need to know is that you didn't actually order anything and that you can't explain this no i ordered nothink you know mr. i'm sorry if i'm repeating myself but we do have to ask you have no explanation for

these orders. so we're not equals no i have asked my friends and my sister has respect for. all the criminals merely grabbed her name and date of birth from facebook the resulting trouble for claudia her coat was enormous hers was a case of straightforward conventional identity theft. but the repercussions brought her to the edge of a nervous breakdown. going to is sadly not surprised we asked him to comment on our research. he is convinced that the growing use of biometric data in digital systems will change the nature of identity theft with dramatic consequences for victims. then your door once your data have been misappropriated you will not be able to use them again. users with

a stolen conventional password comprising letters and numbers can change at any time what they can never alter is their fingerprint. there's a good deal of evidence indicating that hackers are specifically targeting biometric data. our research indicates that millions of people have been affected. in 2015 the u.s. office of personnel management issued the following statement it reads in part. all records indicate that your fingerprints were likely compromised during a cyber intrusion 5600000 people were affected. cook in the philippines in 2016 hackers broke into an official voter database where fingerprints were stored. 50000000 people were affected.

in india last year there was a security breach in the government's biometric identification system known as. point 2000000000 people were affected. india is the world leader in the use of biometric authentication all citizens are required to submit data for a high tech government passport. people already use that document to register for pensions and benefits if they can't provide it in a fixation with an iris image or a fingerprint they can't access the system or their benefits. last year the government effectively issued a cybercrime alert. dechen large enormous

shown in cyber crimes and cyber the question of cyber security one of the see these issues that i think a glance economy like american. indians biometric databases have been repeatedly hacked into. one of our sources tells us where to look on the internet to find the stolen material. we find both conventional and biometric information including digital fingerprints. we also learned that criminals have used this data on the black market to buy state subsidized food. we travel to the city of about 300 kilometers north of mumbai where they have took place. on something we find several people whose data were stolen.

one of them agrees to talk to us on camera. danish gojira is a furniture dealer he's 40 years old. he's going to show us his government receipt book. it indicates whether someone has received food benefits but there are no entries in the book. egeria is doing ok financially so he doesn't need government help. but the official online monitoring system shows that gojira has purchased food. whoever did it used good year is biometric data his hard number. i fear. this confirms somebody has stolen my fingerprints. the government these days has been

emphasizing fingerprints they've made it mandatory to link bank accounts without hard numbers at the moment there is pressure on the police but i'm afraid she's sitting. here as prints are now available on the digital black market. if someone uses them to commit a crime could become a suspect. people in the west have largely not paid enough attention to this problem. in india hackers have managed to penetrate the world's largest biometric database which contains information on more than a 1000000000 people. investigative journalist rock not discovered the leak in the database she wrote a newspaper article on the story in january 2800 and described how she contacted some criminals on line. philthy sold her

a software program that provided access to the government's biometric identification system with access to the data of 1200000000 people it was illegal for her to buy the program and she faced the possibility of criminal charges but she did it anyway i knew all. but i have to do it because. before me many reporters they tried to highlight this issue they wanted to flood this issue but they couldn't do it because they would not having any concrete evidence to prove they came. so i had 2 options to go for the call for this illegal way to follow this illegal we want to keep on flogging not to keep one highlighting the shows which no one was going to be keeping since it was a matter of national security as well as the privacy of every indian i took. to that decision and i finally went ahead with this software chasing the software patents i bought. the government continues to deny that someone broke into the

system. shows us the original email that she received from the hackers. this message i received from my previous anonymous sources both of which offer the movies well. maybe even the big guys before they charge the equivalent of about 5 euros for access to the system at the time just about anyone could buy the software program. and say. when sensitive data is hacked whether through carelessness security gaps or theft the consequences for those affected can be devastating. despite numerous serious incidents last year the indian authorities issued another call for citizens to submit biometric data. this letter to an individual was titled enrollment of residents whose biometrics matched that of other residents the recipient was told.

if your biometrics are not updated within 15 days you're out our number will be deactivated. the authority in question refused to comment when we asked how fingerprints and irises can be assigned to a number of individuals. for this amounts to irresponsible behavior. when the state collects data on. citizens they in turn expect the state to take care of those data evidently that's not the case here but to be fair it's sometimes not possible. so you have to ask whether it's worth conducting a universal collection of citizens data given the risk that it could trigger total chaos this is an absolute as coasters and. the police have to remain anonymous when investigating criminal behavior on the

dark with just as the criminals to. the fullest and the police therefore use fake identities to make contact and wrap up a transaction. they need that online deal to be sealed in order to prosecute criminals in the real world. we want to show our findings from the dark web to an expert from the cyber crime task force of the getting in city police in germany. in the meantime we get a response from the person offering fake passports they tell us to send them the

relevant data and even the desired place and date of issue and fingerprints. the post comes with a price list we pretend to be interested in a spanish passport valid through 2028. the post offers worldwide delivery. police investigators spend violent specializes in dark net marketplaces and is familiar with how the criminals work. we showed him the results of our research. this is one of the it's a commercial site not unlike e-bay or amazon buyers want to have a logo for recognition purposes and their ratings to. these sites sell identities

and buyers determine what data they want to have included. that might be made up names or those of real people but if you know i'm going to come across. the i'm going. including photos and fingerprints which criminals used to create a new fake identity while also providing replica fingerprints. on the go all the criminal needs is a suitable means of reproduction for this biometric feature. we've often seen fingerprints by the good will but more recently 3 d. printed faces in order to deceive apple face id to toshiba or it's a growing trend to include those whom. so far the german black market usually deals only with conventional data you can buy lists of names addresses and financial information for 6 to 10 europe's. no one seems to be offering biometric

data not yet and it seems to be merely a question of time until they do but the are far of the experience has shown that all databases are hackable and have been hacked are good. we finally get a response from the person who offered to sell us a fake passport. he wants various kinds of data a fingerprint scan a copy of our reporter's signature and an id photo. he shows us a sample of how the fingerprint scans need to look. we agree to this deal for journalistic purposes only. this person does not operate on the dark web which is unusual we used a computer program to generate the fingerprints and the id photos so no such person actually exists. we send off the data and add aquarian about the passport.

will this data be in the chip. and. they say they can forge passports that have biometric features. but is that really possible. today's id documents are supposed to enhance security for travelers and speed up check in procedures as here at munich airport. biometric data is integrated into an invisible radio frequency identification chip in the passport. the chip transmits facial data stored in the passport to a monitoring facility. there the data is compared with the digital material that's stored here on the screen at the time of the check. if they match the passenger is allowed through the security gate. the passports from different e.u. countries may look practically identical but we're told the technology involved is

often different. you just long to get through these each country issues kids who are these are if i had a chip so if i have a german passport i need to keep from germany is because if i have a french passport to keep from france it's not going to have been this impulse over there but i insist on. biometric passports are supposed to be forgery proof but the european border agency frontex told us in an official response. there have been some cases in the e.u. and showing an area of forged passports that had a manipulated chip. another disturbing development is that hackers are now able to access facial data included in european passports. and. here we use a simple mobile phone app to activate the chip in

a german passport. and not encrypted data in some non european passports can sometimes also be accessed. the passport forger finally gets back to us. he says please send the money to the bitcoin address below so he can get started. this is where we break off contact and then hand over our research to the german authorities we have no idea whether we would actually have received the forged biometric passport that the seller promised. when stolen data appears on the dark web hackers have usually acquired it by exploiting a vulnerability in a software program it takes about a week for these security loopholes to be discovered and closed. but then it's usually too late to help those whose data have been compromised data

flow in many i.t. systems is not properly monitored. and security specialists say there are between 4 and 8000000 attacks every day. germany is 4th on the list of countries that have been hit hardest. ve use new data protection regulations call on private sector companies to do more to protect sensitive information. but germany remains vulnerable to cyber attacks. regulations don't seem to have helped much when it comes to improving the security systems the. professor is the executive director of the e use agency for network and information security. expertise is widely respected in the i.t.

sector and he's increasingly concerned about the spread of identity theft. right now he's on his way to an i.t. security conference in parts to em. we asked him why experts can't get a grip on this ominous problem. isn't that a lot of companies are bringing i.t. products on to the market but no one seems to know whether they actually provide proper security i think is that possible today this is sort of like unfortunately yes when i buy a product i don't know what sort of security features it might have. you know that's the case was typical fingerprint readers or a facial recognition software a smartphone. but it's not there's no guarantee that it will do what the manufacturer claims all i can do is hope that it does. hopefully. the head of the e.u. agency for networking information security can only hope that

a product is safe. i.q. security will be a key topic at the potsdam conference. a lot of participants say that the new regulations don't go far enough to protect private data which govern the death of regulations alone solved data security problems the private sector and security authorities should adopt practical solutions but that's becoming more difficult to do because. as you have to look to that is if you have to skip liability for i.t. products would be a big help when there's major pressure on developers to be the 1st to get products on the market that often leads to products that have not been verified being made available that were to merge is pretty soon that they're vulnerable to all manner of attacks that could some. and that enables hackers and cyber criminals to access the data on that service without authorization. of the dot and these so

action here would help but i think it's time to kind of as a decimal to have. e.u. regulations impose heavy fines for companies that don't protect identity related data. but what if the data protection software has security loopholes that make it vulnerable to hackers. if you buy it and women. says that the manufacturers are not liable for this problem. and what is most if there has to be a point where somebody in the chain sells a non-secure product that does not meet data protection stipulations with it off and they have to be made liable somehow. seen do you see a chance of comprehensive i-t. liability after. a moment is that right now it's not politically expedient to do ties you now keep monitoring the situation. is on his way to the e.u.

net security office in athens where there's plenty on the agenda. the e.u. is working on a new on line guidelines. we've come to the university of least in trying to visit. he's the co-director of the cyber security research center here. he says german authorities need to do more to protect personal data despite the new e.u. regulations. the new agency has been set up to implement those regulations but for other believes that the legislation doesn't go far enough . to make his point that many i.t. systems are open to attack he's written some software code for us. this fingerprint scanner is similar to the ones that are used by german authorities . provide

a software captures a print. just open the capture area the fingerprint scan indicator starts flashing for you we put the print on it and it scanned into the system the bureau says forster. the image of the printer is transferred to a separate computer for processing. but there's a big security risk here because the transfer is not encrypted. florida has written a software program that exploits this flaw in the security system. it's active you vision all activate the trojan with a keystroke and when i press a capture the program replaces the real data with some random material that we choose. will use an image of a skull and crossbones for this test. and. this

software can also create fake fingerprints that look absolutely real money pretty good for. a hacker who has access to the image data including fingerprints can choose to copy them or alter them stories own purposes. as that's how fake fingerprints can end up in id documents that could be used by criminals for could new york to win tin can the system would a government office be able to spot and intercept this sort of malicious software. is doing a good deal we've seen cyber attacks on the goodness talk of nuclear power plants and energy companies that would go into any computer is vulnerable to attack. and of course that includes computers and population records offices in computer infancy and could. in germany millions of citizens have submitted their fingerprints in recent years using scanners that don't offer proper security

protection. see that in hanover is the world's biggest computer trade fair. among the vendors is the company behind the fingerprint scanner. what do they know about this serious security loophole and are they. willing to comment. the company in question is derma log a subsidiary of germany's federal printing office and as such a government agency. to. provide biometric authentication for governments who want to ensure that when they issue a passport driver's license or similar document the bush on that individual is unable to engage in identity fraud duties between. their standing kluges a presentation of a similar scanner we put it to the test this thing martha stewart is that photo then encrypted in the device just to know it's sent to a p.c.

where it's in code it see her turn to be called it a hot time to spoof as if so photo on the transfer and then coding coded as a kind of but no corruption on the device no with this yes on the so in future even though the images will be encrypted before they leave the device opposite oh it's a demand being made increasingly by banks and somebody right now we can do encryption starting with the p.c. can be up to see. if it safe if this is so this device right here is also used it does this get the flick of off button i'm going to manage it by the citizens registration agency. so i can show you that you know yeah ok. but the stats that just this is the z f one used by the registration agency is this is that the same one it's a bit bigger. doesn't have encrypt. it likewise starting on the p.c.'s often could

see up to him puts it in a photo here then in 4. months we'll be back so what else do banks want to see the bank and they want to know who they're dealing with this besides you know your customer thought this is all stuff to talk about what do they want to. you know fuzzy on i'm doing because they're assuming a huge scope. criminal minds wish to do this story they want to prevent somebody capturing that fingerprint once it's transferred to the p.c. it seems to conceive of fun not to see the occupation. and that's possible yes too much. so the company is aware that the device is vulnerable something the german government is surely aware of given that the loophole has been around for 10 years. all the more puzzling then is the discovery of this article by a member of germany's federal administration agency which recommends this very same

thing or print scanner for the schengen system a scanner that's vulnerable to hackers in germany and worldwide using any fingerprints or other personal data. the problem is one of global proportions. is sure mr wood ernie you know but don't forget we have not been exactly state of the art for the last 10 years and there is room for improvement as are good with encryption and the hardware itself for example in the hard to get it done via ordinary citizens have the right to expect top security for our data if that's true and that's not the case. does it really is time to take action as that so it's don't go and says it's news business and. we talked to officials at the german parliament and at various government ministries about these security problems. and got this response from the interior minister and . the collection and or processing of personal data with or in

information technology systems can be considered reasonably secure. not exactly a ringing endorsement. the european union needs to do more to prevent the misuse of data based on fingerprints. for years e.u. external border facilities have been using a scanner that's not secure. proved that by creating replica fingerprints that the scanner accepted as real. on a more sinister level terrorists also use these replicas to hide their identities. last december police in turkey made a shocking discovery after raiding a suspected terrorist hideout in the city of care she hear. the raid was filmed and we managed to get

a copy of the video. the authorities arrested 10 members of the islamic state organization ringback ringback. they also found evidence indicating that the individuals had been using forged biometric identity data. to. police seized cash identity papers fingerprint molds and replica fingerprints all. the investigation later determined that the suspect had used a fake prince to provide identification for money transfers. this suggests that terrorists are fully capable of using forged biometric data. for until it's clear that criminals and particularly terrorists are using this technology. to traders are able to steal fingerprints by hacking a database or they simply forge them. and the fake prints are then scanned into

a specific database. that allows them to set up a fake identity profile that can then be used anywhere that uses fingerprints as a form of identification. like airports and passport facilities and unfortunately to dance with you. it's aware of. this data can also be used to open various kinds of secure accounts living up to commit up there is that dangerous. it will make stream way dangerous because we trust that biometric data for the whole but we often ignore or don't want to believe that it's fairly easy to manipulate that data was pacy that. the illegal trade in digitized biometric data is booming. systems have become increasingly vulnerable governments and private sector companies are duty bound to protect our personal data because once that information falls into the hands of criminals it's gone forever.

a chip into the world of. many states opening its pavilion and providing a 1000 the minimum to spectators on all world. even . you 30 minutes.

it's been 15 years since the man. she was the 1st man to walk. as a small boy she dreamed of the stars. are much the same thing no matter how to. church or go to the poll. master john to be took part in the greatest adventure in history. neil armstrong was his destiny starts july 20th on t w.

this is d w news live from berlin hong kong protesters keep up the pressure. these are live pictures of the massive rallies calling for hong kong's pro beijing leader to step down times after she bounced to pressure and transplant for a controversial extradition law. also coming up to israel for paris to name a town after u.s. president donald trump after he recognized the golan heights as israeli territory correspondent tell does one find the middle.