That being said, give it a couple decades
It might be hard to tell peoples' signals apart with the confidence of a strong password, but individuals do respond pretty differently in terms of how long it takes to appear, how quickly it grows, how much of a spike is observed, small offsets, etc.
[1] https://en.wikipedia.org/wiki/Steady_state_visually_evoked_p...
If you are curious in this stuff, I am pretty familiar with this stuff, and my startup[2] uses consumer EEG's regularly. Our single largest concern is actually signal correction due to movement / other environment factors[3].
[1] http://synaptitude.me/blog/a-quick-intro-to-ssvep-steady-sta...
[3] http://synaptitude.me/blog/using-computer-vision-to-improve-...
Well, unless the cops use neural jammers or something. How cyberpunk.