Biometric personal data, changes in regulation of its processing and market impact

Ruslan Rakhmetov, Security Vision

In the last few years, the government has significantly increased its interest in the field of biometric data processing (primarily face and voice recognition technologies). This interest is due to both the opportunities offered by these technologies and new (generated) threats.

If we talk about new opportunities, it is the simplification of the process and increasing the accuracy of human authentication, which is convenient for users and beneficial for businesses. At the same time, these technologies allow for the full realisation of remote authentication. In the case of the credit and financial sector, this resulted in prioritising this area at the level of the Central Bank and initiating (together with the Ministry of Communications) the creation of the Unified Biometric System (UBS). The developer and operator of the UBS is Rostelecom.

This system was supposed to have a positive effect on the credit and financial sector in terms of simplifying competition between organisations - providers of financial services and, as a consequence, reducing the cost of services for the population and enabling small organisations to attract clients more easily. At the same time, new threats related to interception, changes in the authentication process and even biometric forgery (make-up, deep fake technology, etc.) have also emerged.

In order to minimise information security risks, the EBS has been created using a set of technical, organisational and technological measures. And for banks (business users), the mega-regulator separately issued the Bank of Russia's Directive No. 4859-U dated 9 July 2018 with a list of current threats and the Bank of Russia's Methodological Recommendations No. 4-MR dated 14 February 2019 on neutralisation by banks of security threats relevant to the processing, including collection and storage, of biometric personal data, their verification and transmission of information on the degree of their compliance with the provided biometric personal data of a citizen of the Russian Federation. In order to motivate the use of EBS, a tariff policy with elements of ‘cashback’ was developed, when for the use of biometrics a fee is charged from the organisation and 50% of it is transferred to the organisation that collected and provided to EBS the samples of biometric personal data. Also, through the requirements it is enforced to equip bank branches with biometrics submission points - the Federal Law of 7 August 2001 N 115-FZ ‘On Combating Legalisation (Laundering) of Proceeds of Crime and Financing of Terrorism ’ establishes a mandatory possibility to use EBS for remote identification. At the moment the solution, judging by statistics, is not particularly favourable to banks - the simplest version costs from 1 million rubles, and the number of biometric copies is approximately 200 thousand and is growing slowly. Judging by the statements of the authorities, the security of biometric data comes to the fore, and all measures will be reduced to centralisation of biometrics processing and protection in one place, which is generally understandable - from the point of view of confidentiality the advantages of storing and verifying biometrics in a single system are obvious. Creation of a single state system based on the Unified Biometric System (UBSS) and working only with it will change the current ‘landscape’ of technologies that use biometric personal data - all commercial systems will have to ensure integration with the UBSS and work not with biometrics itself, but with vectors.

At the moment, in order to implement this policy, amendments have been made (some of the requirements come into force from 01.09.2022) to 149-FZ of 27 July 2006 ‘On Information, Information Technologies and Information Protection’, as well as published Government Resolutions (#1815 of 23.10.2021, #1799 of 20.10.2021) and Order of the Ministry of Finance of the Russian Federation (#930 of 10.09.2021), which defines a number of requirements and features of operation. Let's consider the key ones.

What we would like to draw attention to in 149-FZ:

• The operation of the EBS is essentially determined by the Government of the Russian Federation in coordination with the FSB, Roskomnadzor and the Bank of Russia.
  
• Individuals can place their own biometric data using the EUIA and a foreign passport with a chip.
  
• At the moment, the EBS stores information about face and voice, but it will be expanded. The composition of biometrics is determined by the Russian Government.
  
• Processing of biometrics (and work with the EBS) must be carried out in accordance with the requirements for the protection of biometric personal data.
  
• Organisations can be checked by FSB, FSTEC, Roskomnadzor, Bank of Russia within their competences.
  
• The Ministry of Finance of Russia defines
  
• requirements for work with UBS (collection of biometrics, storage, etc.)
  
• determines the forms of confirmation of compliance of technical means with the requirements
  
• determines methods of biometric data quality verification
  
• defines the list of security threats relevant to the processing of biometric personal data
  
• distributes on a free of charge basis for individuals and legal entities the cryptographic information protection software (FSS certified) necessary for work with UBS
  
• ensures work with biometrics in MFCs
  
• accredit organisations that carry out identification and (or) authentication using biometric personal data of individuals.
  

• EBS operator (Rostelecom)
  
• ensures interaction with external users of the UBS
  
• provides information from the UBS upon request to the Ministry of Internal Affairs and the Federal Security Service
  
• at the request of an individual (or state special services) delete biometrics from the UBS
  
• maintains the register of users (state bodies, local self-government bodies, financial market organisations, other organisations, individual entrepreneurs, notaries) of the UBS.
  
• Separates organisations that carry out identification and (or) authentication using biometrics from those that carry out only authentication (i.e. the user is pre-identified by other means).
  
• Collection and processing of biometrics in other systems is prohibited, but is allowed in cases established by the Government of the Russian Federation in coordination with the Central Bank of the Russian Federation (seems to be for large biometric data operators, e.g., such as Sberbank) provided that:
  
• fulfilment of the security requirement
  
• meeting the requirements of the law of 26 July 2017 N 187-FZ ‘On the security of critical information infrastructure of the Russian Federation’ and connecting to GOSSOPKA
  
• passing accreditation in the Ministry of Finance of Russia
  

• All systems with biometrics must either connect to the EBS by submitting previously collected biometrics there, or obtain an exemption (by decision of the Government), or stop working with biometrics.
  
• Organisations and their management are not on lists of involvement in extremist activities, terrorism or proliferation of weapons of mass destruction.
  
• The organisation's management has no unexpunged or unexpunged criminal record.
  
• There is no record of unreliable information about a legal entity in the Unified State Register of Legal Entities in respect of the organisation.
  
• Data transmission channels must be protected with the use of SCSI.
  
• Tariffs (including mandatory ‘cashback’ for biometrics providers) are set by Rostelecom, but in accordance with the fee calculation methodology approved by the Ministry of Finance of Russia in coordination with the Bank of Russia.
  
• Organisations can use information systems of organisations accredited to work with biometrics, provided they meet the basic requirements (in fact, everything except accreditation by the Ministry of Digital Data Protection of Russia).
  
• Accreditation is carried out if the organisation fulfils the following conditions:
  
• the share of foreign participation is less than 49% (unless it is a special case determined by the Government
  
• minimum capital of not less than 50 million roubles
  
• availability of insurance against incorrect authentication in the amount of not less than 50 million roubles
  
• availability of a licence from the Federal Security Service for the development, production, distribution of encryption (cryptographic) means, information systems and telecommunication systems protected with the use of encryption (cryptographic) means, performance of works, provision of services in the field of information encryption, maintenance of encryption (cryptographic) means, information systems and telecommunication systems protected with the use of encryption (cryptographic) means
  
• ownership of hardware encryption systems
  
• at least two employees with higher education in the field of information technologies or information security.
  
• compliance with the requirements for the business reputation of the sole executive body or members of the collegial executive body established by the Ministry of Information Technologies and Information Security of the Russian Federation.
  
• compliance with additional requirements for the sole executive body, such as Russian citizenship, absence of an unexpunged or unexpunged criminal record, not having been held criminally liable under Articles 183 and 283 of the Criminal Code of the Russian Federation for illegal receipt and disclosure of information constituting state, commercial, tax or banking secrets, absence in the lists of information on involvement in terrorism, etc. during the five years preceding the date of application for accreditation.
  
• the organisation applying for accreditation has not had its accreditation prematurely terminated within three years preceding the day of submission of a new application
  
• the person entitled to act without a power of attorney on behalf of the organisation applying for accreditation was not a person entitled to act without a power of attorney on behalf of another organisation carrying out identification and (or) authentication using biometric personal data of individuals, the accreditation of which was early terminated within three years preceding the day of application submission.
  

• Additional increased requirements are imposed on organisations performing identification or identification and authentication:
  
• minimum capital of at least RUB 500 million
  
• insurance against incorrect biometric verification in the amount of at least RUB 100 million
  
• connection to GOSSOPKA
  

• Scheduled inspections of accredited organisations must be carried out at least once every three years.

The next document - Government Decree No. 1799 of 20.10.2021 defines the rules for accreditation of organisations working with biometric personal data. These rules define the requirements to the form of application for accreditation and related documents confirming the fulfilment of requirements to organisations, as well as regulate the terms of application review and fixation of accreditation in the specialised list of accredited organisations. We would like to pay special attention to the requirements for foreign organisations - they are required to place technical facilities on the territory of the Russian Federation and not to be representatives of a foreign state included in the list of foreign states committing unfriendly actions against the Russian Federation, its citizens and legal entities.

The Government Decree No. 1815 of 23.10.2021, in its turn, defines a list of cases of collection and processing used for identification or identification and authentication of biometric personal data in information systems of organisations - a kind of white list of application of information systems using biometrics, in particular for identification (authentication):

• drivers of passenger taxis
  
• carsharing drivers (for renting cars for up to 24 hours)
  
• when entering the territory of organisations via ACS on the territory of these organisations, except for organisations of the defence industry, nuclear power industry, nuclear weapons, chemical, fuel and energy complexes, organisations belonging to transport infrastructure facilities, critical information infrastructure entities, facilities, facilities the commission of a terrorist act on the territory of which may lead to emergencies with dangerous socio-economic consequences, regime facilities, pre-schools, and other organisations.
  
• when participating in a meeting of participants of the civil law community.

Also the order of the Ministry of Finance of the Russian Federation №930 from 10.09.2021 defined the order of processing biometrics, where it is worth paying attention to the following features:

• the requirement is specified (for those unsupervised by the Bank of Russia) to inform the Ministry of Finance of Russia about identified IS incidents, not later than 1 working day
  
• the requirement for annual assessment of compliance with information protection requirements by an external organisation with a licence and informing the Ministry of Finance of the Russian Federation of the results of the assessment
  
• technical requirements for biometrics (images and voice) are defined, such as resolution, colour depth, head rotation angles, illumination, data formats, signal-to-noise level for voice, quality, etc.
  
• quality check is performed using software provided by Rostelecom. Low-quality biometrics shall not be collected.
  
• biometrics (for identification/authentication purposes) shall not be stored except in the EBS.
  
• only biometrics not older than 5 years should be used
  
• maximum (acceptable) false match probabilities for different cases of biometrics analysis are defined
  
• the requirement to use at least 5 different algorithms for detecting an attack on a biometric submission

When analysing this set of requirements, a functional question also arises - what about autonomous systems for recognising, for example, faces (for example, such a feature is now available in smart intercoms)? Such technologies are, in fact, now prohibited.

As we can see, at the moment there is strict regulation and restriction of biometric technologies, which increases security. However, such a restriction may cause the Russian Federation to lag behind in these technologies - the development of new directions, testing and, most importantly, the entry threshold to this market will be significantly complicated.

What is biometric personal data?

Biometric personal data are unique physiological and biological characteristics of an individual that can be used to identify them. These characteristics include fingerprints, facial scans, iris scans, voice analyses, hand geometry and other biometrics.

The main feature of biometric data is its uniqueness. No two people have exactly the same biometric characteristics, making it an ideal tool for authentication and identification. When biometric personal data is used to access systems or data, it increases security and eliminates the problem of lost or stolen passwords.

Applications of biometric personal data

1- Authentication: One of the most common uses of biometric personal data is user authentication. Using fingerprint scanning or facial recognition, devices can ensure that only an authorised person is granted access.

2- Mobile Device Security: Many modern smartphones and tablets are equipped with sensors for fingerprint scanning or facial recognition. This makes the devices more secure and prevents unauthorised access.

3. Data protection: Biometric personal data can also be used to protect sensitive data. For example, a biometric scanner can be integrated into a system to access servers with sensitive corporate information.

4. Password Replacement: Biometrics provide an opportunity to forget about complex passwords and PINs. Instead, you can use your unique biometric characteristics to access your devices and data.

5. Medical Security: In healthcare facilities, biometric personal data can be used to secure access to medical records and patient personal data.

Features of biometric data

However, despite all the benefits associated with the use of biometric personal data, there are also certain risks. For example, biometric data can be compromised if leaked and cannot be changed like a password or PIN. Therefore, protecting and encrypting biometric data becomes a critical task.