CCC captures U.S. military biometrics database
ccc.de
ccc.de
Also USA:
> The entire population of Afghanistan was biometrically catalogued - supported by the German Bundeswehr. The motivation for this systematic collection of fingerprints, irises, faces and DNA was to enable the distinction between good and bad people. Programs such as the Automated Biometric Identification System (ABIS) were designed to identify known criminals, as well as local collaborators or Afghan security forces, at any time.
I'm far more concerned about the Americans, many here, who's knee jerk reaction is to engage in all sorts of mental gymnastics to give the government the undeserved benefit of the doubt and minimize the significance when these things come to light. If I wanted to give them the same undeserved benefit of the doubt they give government I would say they are ignorant of the danger.
“I dont know why people are surprised the government is doing [x]… [insert minimization]”
You've taken it as something totally not what was the spirit of the thread. But sure, eliminating laws that make victimless crimes a possibility seems like a good idea. Have fun getting that to happen.
The exact same thing can be said of your reframing of "physical harm" to be "violence" exclusively. You've clearly never debated someone from the voluntarism persuasion, because otherwise you'd know about the concept of externalities. But here is your chance to shine: will you acknowledge the fact that industrial pollution causes physical harm and that your unnecessary reframing creates that blind spot, or will you double down and hamfistedly attempt broaden the definition of "violence" to include pollution (and a thousand other things I could follow up with)?
Some countries require fingerprints for passports.
I'm not sure why all of this is a big deal?
Cedes control, which is a political and minor economic issue.
National ID was a core GOP platform issue post 911. It never happened because both extremes of the political spectrum are against it. Right wingers are into the mark of the beast stuff and see it as a tool of government tyranny. Left wing types see it as a way to disenfranchise voters and deny resources to marginalized people.
Both are right and wrong. So the status quo prevails.
It would also streamline lots of use cases that require ID. Various federal programs administered by states require that you authenticate people in different ways. The states spend millions to do a shitty job (driven by Fed requirements) for unemployment, social services, Medicaid, etc.
Second of all, the most common state ID is a drivers license. A federal ID would not replace the state's need to license drivers.
How do you know?
State motor vehicle orgs are revenue generators. ID operations are expensive and operationally risky.
A federal ID would put the states in the business of selling endorsements. A drivers license would be like a deer tag or fishing license - higher margin and lower overhead.
It would also enable online services and local/county/state government could significantly reduce workforce and other expenses.
The answer is that they'd have to rely on the federal government instead, and given the functional relationship between the states and the federal government, states just aren't going to voluntarily give up that power and trust them to do this for them. It is in the existential interest of the states to maintain as much power as they can, despite the associated cost.
Because state dmv compacts govern data exchange and DMVs are all about selling stickers, state programs don’t have access to the ID data they own, except for law enforcement purposes. Companies like id.me, experian, etc buy that data from states and the. sell it back. (usually do a shitty job at it to boot)
which is funny since the GOP were so adamantly against a national ID when the Clintons tried to introduce it.
For “normal” people, it’s a non-issue. Once you get to the people who fall out of the funnel, it gets more complex. How do you keep ID current for a 95 year old in a nursing home? Or a kid who can’t get vital records documentation?
Compulsory federal ID is a weird issue that the extremes of political discourse agree on, and the moderates mildly support or meh.
A kid that can't get vital records is also going to have an issue with getting a state ID. So again, doesn't matter if state/national.
If this is provided free of charge wouldn't it actively enfranchise people who don't presently have ID?
> It also forced all people, great and small, rich and poor, free and slave, to receive a mark on their right hands or on their foreheads, so that they could not buy or sell unless they had the mark, which is the name of the beast or the number of its name. [1]
Sources:
0 - https://en.wikipedia.org/wiki/Uniform_Interstate_Family_Supp...
1 - https://www.biblegateway.com/passage/?search=Revelation%2013....
Social security numbers (or cards) are not ID, in any meaningful sense.
> And if you're a man your selective service number, too.
Also not an ID.
> Both are technically not mandatory, but the steps to avoid them are incredibly byzantine and lock you out of lots of social services.
“Immigrate to the US after age 25” isn’t that byzantine. And, actually, selective service registration is technically mandatory, during a narrow age band.
You can't board a flight with it because there's no photo, but it's still a near-universal way to ID each person residing in the US.
They are, pedantically, "an ID". Just like a UUID is an ID. They're just not the type of ID we're talking about: an ID that authenticates the identity of a human who possesses it.
So will you, because your database is now bleeding red-hot PII across every query and foreign key. Chances are you'll now end up with a web interface that uses SSNs in its URLs.
Holy hell, how was this even considered?
Exactly. When we discuss “national ID” we are talking about an identification document: a tool that allows authenticating a person; an SSN doesn’t do that. It is an identifier, not an identification document.
(We do have a actual national IDs, but they aren’t universal or mandatory, either in theory or in practice, though they are required for certain purposes and will be soon for more, and are increasingly common. Passports, state-issued IDs meeting REAL ID standards, Enhanced Driver’s Licenses, etc.)
Sort of. The defence in America against a Taliban-style takeover is more in its decentralisation. From politics to financial records, the data are held in multiple spots, making an automated canvassing difficult. The downside of that decentralisation is a lot of corruption and fraud can go uncaught.
That's the people, not the government. Federal government has wanted it's cattle bran- I mean Federal ID for decades now.
The main worry was that we basically handed the Taliban a list of Afghan translators and US cooperators. It's been 18 months since then. Does anyone know if there were consequences for those people? Has the Taliban acted on this database to enact retribution?
[0] https://www.technologyreview.com/2021/08/30/1033941/afghanis...
There would need to be some protection for workers like there is for whistleblowers but smaller things like this don't count as whistle blowing.
In this specific case it's very easy to morally justify such data collection to yourself, after all your friend was just torn to pieces by an IED placed by partisans, and another one two weeks ago.
Russians are really "good" at this counter-insurgency game, they simply torture, run concentration camps, ethnically cleanse by sending to Siberia. Worked in Chechnya, works now in Ukraine.
https://www.voanews.com/a/biden-signs-bill-to-block-us-railr...
'... Biden administration this week used the provisions of a 96-year-old labor law to force unions representing thousands of railway workers to accept a contract ...'
> Unlike the National Labor Relations Act, he said, which leaves both labor and management with "economic weapons" they can threaten to use (strikes for unions, and lockouts for management), the Railway Labor Act has a provision allowing the government to block a strike from taking place.
It's not only that, it's also that the money is really good, comparatively speaking.
One of my close friends is a tech guy and works for the biggest European defence company, which is mostly a French-German alliance (they're also in the business of making planes), and two of his last job stints abroad have been in Afghanistan and in Saudi Arabia. There's no way he could have made the sort of money that he made had he decided to work for a local, very boring company (I live in an Eastern European capital city).
It is often voluntary lifetime debt slavery to have payments on the latest gadgets/car/timeshare/oversized house.
Recently train workers union had working conditions crammed down on them by no less than Biden. If the workers were not in debt slavery they could have quit. Biden showed a union they don't have a choice when their members are debt slaves.
Your protection will arrive when you change your lifestyle to get out of debt slavery.
-I hear your concerns and agree. There are strong protocols set in place to make sure devices are taken care of after use, and only personnel trained on this device may use and access it. Don't worry, they know what they are doing. We can add that encryption into firmware v2 so relax. Did you sign up for that conference in Florida btw? It's going to be the bomb, sunshine, fun like no tomorrow!
> Jacobsen's gripping account of how a platoon's deployment revolved around biometrics and how it ultimately led to a grave betrayal of justice is a must-read. Jacobsen fails to substantiate her connection between counterinsurgency and domestic policing norms. Nonetheless, she makes a compelling case for why deliberate thought must go into how governments use biometrics in the future. She rightly points out that citizens of the U.S. must be wary of the creep of battlefield biometrics into everyday policing. Questions still exist as to who should own biometric data of populations, what rights individuals have over their biometric fingerprint, and who should have access to such databases, especially when a war is over. Perhaps a future Geneva Convention-like treatment of biometrics is the answer in our ever-connected world.
Given the well-known cascade of surplus military equipment to domestic police forces, it seems wise to be aware of this trend.
I recommend this because when I read the headline I assumed it was referring to the Defense Biometric Identification System (DBIDS) which is the central system used to verify US military, dependents, contractors, GS civilians, etc., when accessing US military bases or other secure areas.
Of course, it all comes down to organizational issues in the end (they knew about the risk and ignored it), but this seems like exactly the kind of thing that politics want to prevent when they throw around money for "cybersecurity".
I wonder if an affected individual could bring this before the European Court of Human Rights for privacy (article 8 ECHR).
> S and Marper v United Kingdom [2008] ECHR 1581 – Retention of DNA information in respect of persons arrested but not convicted of an offence was held to breach Article 8.
https://en.wikipedia.org/wiki/Article_8_of_the_European_Conv... (section “Case law”)
And all this is still besides the question whether the employment was necessary and the least-invasive method possible. If you can prove a need greater than the lost privacy, as well as the lack of an alternative option, if I understand how the system works correctly, then it's perfectly legal also inside of Germany.
However, you could try to argue that § 5 StGB 12 (Auslandstaten mit besonderem Inlandsbezug) applies https://www.gesetze-im-internet.de/stgb/__5.html
“Taten, die ein deutscher Amtsträger oder für den öffentlichen Dienst besonders Verpflichteter während eines dienstlichen Aufenthalts oder in Beziehung auf den Dienst begeht”
Now, all of this first requires that a crime was committed - and that’s not even clear. If the collection happened on the basis of a law, doing the collection would not be a crime. The article shows no proof that the Bundeswehr mishandled the data.
They are still bound to their treaties.
[0]: https://en.wikipedia.org/wiki/Federal_Constitutional_Court
[1]: https://en.wikipedia.org/wiki/Informational_self-determinati...
Note that the Verfassungsbeschwerde in the climate protection case argued that the state failed to create sufficient laws to protect constitutional rights (sorry, edit, I recalled that wrong): the challenge was actually directed at a specific law, arguing that the law is insufficient to protect constitutional right. It was partially successful in that regard.
https://www.bundesverfassungsgericht.de/SharedDocs/Pressemit...
This, however, is unlikely to be a successful line of arguing here: A law exists, and I doubt the affected afghan people would like to challenge that law’s constitutionality.
(Sidetrack): there are more cases where you can appeal directly to the Verfassungsgericht. A relatively common case is when the police forbids or severely limits demonstrations and time is to short for a regular court to make a decision. This is still similar to going through the ordinary courts, because you’re challenging the constitutionality of a state-actor decision.
What's this hygiene stuff they're talking about? Did they get in trouble with the venues over attendees not showering or something?
When the organizers decided this, it wasn't yet completely obvious that Covid would be "over" by fall.
> "It is inconceivable to us that the manufacturer and former military users do not care that used devices with sensitive data are being hawked online," Marx continued.
I dare say this will be met by many in the west with <shrug>
> And yet all of this was predictable, because biometric databases cannot be effectively or permanently secured against illegitimate interests.
> What happened in Afghanistan is just a foretaste of the many biometric databases that will fall into the wrong hands in the future.
This might stir a few people though - when it becomes commonplace for roaming police in the US, UK, Australia, Germany, etc to carry hand held devices with compressed offline usable biometric ID scanners ...
What could go wrong?
Given that they shrugged off the wrong false accusation, bombing, invasion, and occupation of the same place, it's a sure bet
When the Cambridge Analytica story blew up and Facebook was the main character of the week, I spent an entire 3 hours in a weird state of shock.
Not because of the contents of the story. I was shocked because this story had broken like eight months prior and everybody shrugged then.
But then it was framed politically, and suddenly people gave a shit. It was surreal.
So if you want to get people to talk about it, and be emotionally invested, simply frame it as evidence of [Specific Politician] mishandling [Specific Element of News Story].
It doesn't matter much which politician you slot in there, but current and former presidents on opposite parties can work with different audiences. For example, make unsubstantiated allusions to an alleged stolen laptop and connect the dots through some vague sense of poor data security practices and you can get them to repeat it with fervor.
For prior art, look at how that "litter boxes in public schools" hoax got started: https://soatok.blog/2022/04/06/the-dark-truth-about-the-furr...
(I realize I'm risking devolving this thread into a politics discussion here. I'd like to avoid that if possible. I'm more interested in the "how to motivate people to care about this story" angle, with references to prior art, rather than the specifics of any particular party, person, or scandal.)
To talk yes. But they still don't really care. They just use the story as a weapon against the party they don't like...
It should be possible (although probably only if you can control the message; i.e. if you owned the news media) to hijack the political interest towards a humanitarian end goal.
I say possible here because I haven't figured out the specific mechanics of accomplishing just that. But I'm bad at social situations, so I could be missing something.
Iraq was the false accusation. Afghanistan was correctly accused of sheltering Al Qaida. (That we then allied with Pakistan, who also sheltered Al Qaida, to bomb Kabul is a separate curiosity.)
So we can reasonably assume that biometric data of those two population groups was leaked by left behind devices. Not the entire population, but the two most sensitive groups. Sounds pretty bad imo.
:)
Glad we're all nice to each other in this corner of the web!
Even "Der Spiegel" or the Washington Post would dissagree on this statement.
The Taliban will be able to figure out if they were criminals or Taliban or not.
That leaves a small group of people they can torture to figure out the rest. Just have to hand out these same bioscanners to local police then hand off any matches to the higher organs.
This device had a few thousand people. They can collect hundreds of these devices and rebuild the whole database.
You don't even need to know any specifics: it's a well-known humans tend to punish traitors even if they have a lot in common.
Is this attitude why you and everyone else is making the assumption that exactly every stray biometric identity that can be salvaged from this disaster is guaranteed to be a traitor, and guaranteed to be found and executed by the Taliban? You don't need to explain the Taliban to me - I was born in an Islamic country to a Muslim family - but maybe you can help me understand your alarmist reasoning regarding the biometric identities themselves.
Me: Many people were put in danger
You: While many people were put in danger, there are other people who aren't in danger, so you're alarmist
I don't see where they say that everyone's biometrics are supposed to be on a single ebay-purchasable device. To me, it sounds like separate statements:
1. Those devices contain biometrics of various individuals and were left behind as well as being sold online without being wiped as part of decommissioning
2. The entire population was catalogued in general, and I imagine is stored on some servers somewhere (or, for more privacy, in the cloud)
>Some devices were left behind during the hasty withdrawal of NATO troops. CCC researchers found large amounts of biometric and other personal data when analyzing such devices
That means from six devices there was only one with an intact database and the one with the database wasn't used since 2012. Concluding that the device in question was indeed captured after the retreat and that there is a massive amount of unwiped devices out there without providing data about the other devices is at least misleading because their very own anecdotal evidence speaks against them.
This characteristic can describe most of young human beings and people listed above are young human beings. It's not reasonable to expect "fresh blood" in the scene to be experienced, young and worldly at the same time. When it comes to "being loud" - could also be attributed to the age but being "social media native" and being able to use it as a tool also is an useful (and potentialy powerful) skill
These lists were a scandal a few months ago in Netherlands already as people who worked for the Dutch army in Afghanistan were scared for their lives when the government in A fell and NL was not able to get them out quickly enough and NL didn't destroy the records in the Ambasassy