Sep 25, 2020 16:23:00

It turns out that more than 180,000 traveler's face photos were stolen by hacking and some were leaked to the dark web

The

United States Department of Homeland Security (DHS) has reported that hacking has leaked data containing a large number of images used for biometrics, such as the faces of travelers, onto the dark web. The DHS states that the hack was made to a subcontractor's server contracted by the United States Department of Customs and Border Protection (CBP) in 2019.

Review of CBP's Major Cybersecurity Incident During a 2019 Biometric Pilot
(PDF file) https://www.oig.dhs.gov/sites/default/files/assets/2020-09/OIG-20-71-Sep20.pdf

DHS Admits Facial Recognition Photos Were Hacked, Released on Dark Web
https://www.vice.com/en_us/article/m7jzbb/dhs-admits-facial-recognition-photos-were-hacked-released-on-dark-web

DHS's biometric information database, which is the source of data leaks, manages biometric information of more than 250 million people and can process more than 300,000 transactions a day. It is the largest biometric database in the United States, and the database is shared with CBP and the Ministry of Justice in addition to DHS.

For this reason, the database also contained images of people's faces and cars moving across US borders, collected by CBP. These images are used as clues to detect suspected criminals and terrorists.

Perceptics, the subcontractor that caused the image leak, was involved in the processing of facial and car images taken at highways and border crossings. Perceptics transferred a copy of the biometric data in the DHS database to its own server without permission, and was attacked by a malicious cyber attack from a third party.

Around May 2019, Perceptics received an email from a hacker calling himself Boris Bullet Dodger. An email from a hacker said, 'If you don't pay 20 bitcoins (about 22.44 million yen) within 72 hours, you will upload the stolen data to the dark web', but Perceptics refuses to pay. Did. The total number of images stolen from Perceptics' servers was about 184,000, and it was reported that at least 19 images were leaked on the dark web.

CBP suspended its contract with Perceptics after learning that Perceptics had been hacked, but lifted it on September 26, 2019. The reason for this is stated by CBP as 'to enter into a contract to remedy the risks identified in the data breach investigation.' 'We will increase security and prevent this from happening again,' DHS commented.

In response to this incident, DHS said, 'CBP did not adequately protect sensitive data on unencrypted devices used during the pilot of facial recognition technology. Government biometric data protection. Incidents caused by incompetence can lose public confidence and cause travelers to hesitate to obtain and use biometrics when they enter the United States. ' It states.