Uncategorized – Page 130

Ofcom and the Digital Trust & Safety Partnership

The Digital Trust & Safety Partnership (DTSP) consists of “leading technology companies,” including Apple, Google, Meta (parent of Facebook, Instagram, and WhatsApp), Microsoft (and its LinkedIn subsidiary), TikTok, and others.

The DTSP obviously has its views on Ofcom’s enforcement of the UK Online Safety Act.

Which, as Biometric Update notes, boils down to “the industry can regulate itself.”

Here’s how the DTSP stated this in its submission to Ofcom:

DTSP appreciates and shares Ofcom’s view that there is no one-size-fits-all approach to trust and safety and to protecting people online. We agree that size is not the only factor that should be considered, and our assessment methodology, the Safe Framework, uses a tailoring framework that combines objective measures of organizational size and scale for the product or service in scope of assessment, as well as risk factors.
From https://dtspartnership.org/press-releases/dtsp-submission-to-the-uk-ofcom-consultation-on-illegal-harms-online/.

We’ll get to the “Safe Framework” later. DTSP continues:

Overly prescriptive codes may have unintended effects: Although there is significant overlap between the content of the DTSP Best Practices Framework and the proposed Illegal Content Codes of Practice, the level of prescription in the codes, their status as a safe harbor, and the burden of documenting alternative approaches will discourage services from using other measures that might be more effective. Our framework allows companies to use whatever combination of practices most effectively fulfills their overarching commitments to product development, governance, enforcement, improvement, and transparency. This helps ensure that our practices can evolve in the face of new risks and new technologies.
From https://dtspartnership.org/press-releases/dtsp-submission-to-the-uk-ofcom-consultation-on-illegal-harms-online/.

But remember that the UK’s neighbors in the EU recently prescribed that USB-3 cables are the way to go. This not only forced DTSP member Apple to abandon the Lightning cable worldwide, but it affects Google and others because there will be no efforts to come up with better cables. Who wants to fight the bureaucratic battle with Brussels? Or alternatively we will have the advanced “world” versions of cables and the deprecated “EU” standards-compliant cables.

So forget Ofcom’s so-called overbearing approach and just adopt the Safe Framework. Big tech will take care of everything, including all those age assurance issues.

From https://dtspartnership.org/wp-content/uploads/2023/09/DTSP_Age-Assurance-Best-Practices.pdf.

DTSP’s September 2023 paper on age assurance documents a “not overly prescriptive” approach, with a lot of “it depends” discussion.

Incorporating each characteristic comes with trade-offs, and there is no one-size-fits-all solution. Highly accurate age assurance methods may depend on collection of new personal data such as facial imagery or government-issued ID. Some methods that may be economical may have the consequence of creating inequities among the user base. And each service and even feature may present a different risk profile for younger users; for example, features that are designed to facilitate users meeting in real life pose a very different set of risks than services that provide access to different types of content….

Instead of a single approach, we acknowledge that appropriate age assurance will vary among services, based on an assessment of the risks and benefits of a given context. A single service may also use different
approaches for different aspects or features of the service, taking a multi-layered approach.
From https://dtspartnership.org/wp-content/uploads/2023/09/DTSP_Age-Assurance-Best-Practices.pdf.

So will Ofcom heed the DTSP’s advice and say “Never mind. You figure it out”?

Um, maybe not.

The 21st Century’s Four Revolutionary Biometric Events

I define a revolutionary biometric event as something that COMPLETELY TRANSFORMS the biometric industry.

For me, the four events that have revolutionized biometrics in this century (so far) include:

The September 2001 use of commercial planes in a terrorist attack.
The April 2013 Boston Marathon bombings.
The September 2013 introduction of Touch ID on the Apple iPhone.

From Apple, https://support.apple.com/en-us/HT201371

The 2020 (and beyond) COVID-19 pandemic.

If you want to learn WHY I regard these four events as revolutionary, and why I DON’T regard the introduction of the Apple Vision Pro as revolutionary, see my June 2023 post.

Mass Casualties at Arrowhead Regional Medical Center…But Only a Drill

On Monday, March 4, Arrowhead Regional Medical Center (ARMC) in San Bernardino, California was one of two local medical centers to participate in a mass casualty drill.

The objective of the drill for ARMC was to test the hospital’s ability to respond effectively to a surge of patients resulting from a mass casualty incident. Throughout the exercise, ARMC staff demonstrated their proficiency in triage, patient care, communication and coordination of resources. The drill also provided an opportunity for staff to practice protocols for receiving patients, managing supplies and implementing surge capacity plans.
From https://main.sbcounty.gov/2024/03/07/arrowhead-regional-medical-center-participates-in-mass-casualty-incident-drill/.

It’s always good to conduct mass shooting drills in case they are needed in the future.

Or, in the case of Arrowhead Regional Medical Center, in the past.

By San Bernardino County Sheriff’s Department – Public Domain, https://commons.wikimedia.org/w/index.php?curid=45514432

Remember December 2, 2015?

At least 14 people were dead and another 17 injured in a shooting Wednesday in San Bernardino, California, when gunmen who were heavily armed and “on a mission” opened fire during a function at a center for people with developmental disabilities, police said.

Police believe two alleged shooters — a county employee and a woman with whom he was in a relationship opened fire around 11 a.m. at the Inland Regional Center. They were armed with assault weapons and “prepared to do what they did as if they were on a mission,” San Bernardino Police Chief Jarrod Burguan said….

Five people were taken to the nearby Loma Linda University Medical Center, two of which were critical but stable, two of which were fair and the one who was still being assessed, according to a hospital spokeswoman. Six other people are being treated at Arrowhead Regional Medical Center, though their conditions are unknown.
From https://abcnews.go.com/US/police-respond-reports-active-shooter-san-bernardino/story?id=35535995.

Although it wasn’t mentioned in San Bernardino County’s 2024 description of the drill, I’m sure some participants remembered what happened nine years ago.

In fingerprint capture, 14 is better than 20

In many instances of fingerprint capture, whether obtaining prints through ink or through livescan, the tenprint person captures 14 images. Not 10, not 20, but 14.

Why?

Quality control.

Because the 14 images contain two impressions of every print, you can compare the top set of prints (the rolled prints) against the bottom set (the slap prints).

Locations of finger 2 (green) and finger 3 (blue) for rolled and slap prints.

In the example above, if the green rolled print is NOT the same as the green slap print, or if the blue rolled print is NOT the same as the blue slap print, then you captured the fingerprints in the wrong order.

I discussed this in more detail in an earlier post.

If you need Bredemarket’s marketing and writing services to explain the benefits of your technology to your prospects and customers, contact me.

Drive content results with Bredemarket Identity Firm Services.

Multispectral fingerprint readers, the succinct version

There are various types of dedicated fingerprint reader devices, including multispectral readers that can examine the subdermal layers of your fingers. Even if your surface fingerprints are worn away by bricklaying, time, or other factors, multispectral fingerprint readers can identify you anyway.

From HID Global, “A Guide to MSI Technology: How It Works,” https://blog.hidglobal.com/2022/10/guide-msi-technology-how-it-works

If you’re interested, I wrote more about multispectral readers, and how they relate to liveness detection, back in June 2023.

If you need Bredemarket’s marketing and writing services to explain the benefits of your technology to your prospects and customers, contact me.

Avoiding Deleterious Forensic Nursing

Warning: this post discusses sexual assault and child abuse.

Hippocrates. By Unidentified engraver – 1881 Young Persons’ Cyclopedia of Persons and PlacesUpload by RedWolf 05:45, Jan 10, 2005 (UTC), Public Domain, https://commons.wikimedia.org/w/index.php?curid=164808

The Hippocratic Oath imposes duties on medical professionals, including this one:

I will follow that system of regimen which, according to my ability and judgment, I consider for the benefit of my patients, and abstain from whatever is deleterious and mischievous.
From https://www.health.harvard.edu/blog/first-do-no-harm-201510138421.

For people like me who do not use the word “deleterious” on a daily basis, it means “harmful often in a subtle or unexpected way.”

The dictates of the Hippocratic Oath lead us to forensic nursing (as defined by 1NURSE.COM), the invasive nature of some forensic techniques, and what companies such as Foster+Freeman are doing to minimize invasive evidence capture.

What is forensic nursing?

From the U.S. Federal Bureau of Investigation, https://www2.fbi.gov/publications/leb/2002/jan2002/jan02x29x1.jpg.

As 1NURSE.COM notes, forensic nursing is multidisciplinary, operating “at the critical juncture of medical science and the legal system.”

Forensic nursing is a specialized branch that integrates medical expertise with forensic science to provide comprehensive care for individuals impacted by violence, abuse, or criminal activities. These professionals serve as a crucial link between the realms of healthcare and the legal system, collaborating with law enforcement, attorneys, and other professionals to gather evidence, provide expert testimony, and ensure justice for victims.
From https://www.linkedin.com/pulse/forensic-nursing-exploration-intricate-profession-1nurse-com-iedyc/.

When I started my forensic career 29 years ago, I was solely involved in the capture and processing of fingerprints from criminals. If I may be honest, the well-being of the individual who provided the forensic evidence was NOT an overriding concern.

But within a year or two I started to get involved in the capture and processing of fingerprints from NON-criminals who were applying for and receiving government benefits.

For that market we HAD to concern ourselves with the well-being of our clients, to make fingerprint capture as easy as possible, and to treat our clients with the utmost respect.
In the end it didn’t matter, because in the popular mind fingerprinting was associated with criminals, and benefits recipients didn’t want to be treated like criminals no matter how nice we were. To my knowledge, all of the benefits recipient fingerprint programs in the United States have all ceased.

Forensic nursing needs to gather the necessary forensic evidence while preserving the compassionate care that nurses are required to provide.

Invasive forensic techniques

So if we have to take care when gathering information from benefits recipients, imagine the level of care we need to take when gathering information from crime victims. Returning to 1NURSE.COM’s article, here are two of the tasks that forensic nurses must perform:

Sexual Assault Forensics: Specializing in sexual assault examination, forensic nurses provide not only compassionate care but also play a pivotal role in collecting evidence essential for legal proceedings. Their expertise ensures a sensitive approach while preserving the integrity of forensic evidence. Example: A forensic nurse conducting a sexual assault examination may collect biological samples and document injuries to aid in prosecuting the assailant.

Child Abuse Investigation: Forensic nurses are instrumental in assessing and documenting cases of child abuse. They collaborate with child protective services and law enforcement to ensure the safety and well-being of the child. Example: A forensic nurse working on a child abuse case may conduct a thorough examination to document injuries and provide expert testimony in court.
From https://www.linkedin.com/pulse/forensic-nursing-exploration-intricate-profession-1nurse-com-iedyc/.

The “compassionate care” part is important, as Foster+Freeman notes in a separate article:

We have focussed a lot on how the investigation works when looking for crimes of a distressing nature but not actually how this investigation process can affect the victim of these crimes and put the victim first. This period can be incredibly distressing for the victim, and the investigation can make this worse as it is making the victim re-live this experience.
https://www.linkedin.com/pulse/victim-first-forensics-focusing-victims-crime-foster-freeman-gnw6e/

As part of their duties, the forensic nurse has to capture evidence from the very parts of the body that were assaulted during the abuse crime itself. No one wants to go through that again. How can evidence capture be less invasive?

Three ways to minimize invasive evidence capture

While it’s not possible to completely erase the pain that crime victims suffer during a forensic investigation, there are ways to minimize it. The Foster+Freeman article highlights three ways to do this:

Capture evidence via non-invasive techniques. As a supplier of alternate light source (ALS) technology, Foster+Freeman notes that its products can discover evidence, even at the subdermal layers, without touching the victim. “Using an ALS is a non-invasive and non-destructive way to examine potential evidence on the skin. This is especially important when dealing with fragile or sensitive skin, as it minimizes the risk of causing further harm during the examination process.”
Capture evidence quickly. Forensic nurses do not want to prolong an examination. There are ways to gather evidence as quickly as possible. For example, rather than using multiple ALS devices, you can use a single one; Foster+Freeman’s Crime-lite^® X Serology Search Kit is “a multispectral light source that has been made with five wavelengths of light integrated into one unit.”

From https://fosterfreeman.com/crime-lite-x/.

Capture evidence thoroughly. What’s the point of putting a victim through the trauma of evidence capture if it doesn’t result in a conviction? Because of this, it’s important to capture as much evidence as possible. A variety of alternate light sources accomplishes this.

Foster+Freeman is just one of a multifarious array of companies that supply evidence collection solutions to forensic nurses and other forensic professionals.

And no, Foster+Freeman didn’t sponsor this post, although Bredemarket is available to provide writing services to Foster+Freeman or to other companies who need to drive content results.

And now that I’ve successfully used “multifarious,” I need to find a way to use “deleterious.” Keep your eyes open.

Addressing “How” and “Why” in That Order

This is my last chance to squeeze in a Bredemarket blog post before the end of the month, so I’ll just recycle some thoughts that I previously posted on LinkedIn.

Based on some thoughts originally shared by Taylor “Taz” Rodriguez about the perils of “me-too” marketing.

Let’s all be unique

Steve Martin on stage in the 1970s. (And yes I used the “let’s get small” version of this image.) By Jim Summaria – WP:Contact us – Licensing, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=5578555

Years ago, Steve Martin had a routine in which he encouraged his audience to say, in unison, that they promise to be different and they promise to be unique.

Get it?

Apparently some present-day marketers don’t, according to Rodriguez.

If you want to SERIOUSLY grow a service-based company, you need to STOP with the generic social media captions!

We see it all day long, even on paid ads which is sad…

❌ “We help our clients stand out from the crowd!”

❌ “Our experienced team of _____ help to elevate your business!”
From https://www.linkedin.com/posts/madebytaz_marketingandadvertising-paidadvertising-socialmediamarketing-activity-7168953109514280960-9H1N/.

No, repeating the canned phrase about standing out from the crowd does NOT make you stand out from the crowd.

But wait. It gets worse.

The authenticity bot

When I reshared Rodriguez’s post, I wanted to illustrate it with an image that showed how many people use the phrase “stand out from the crowd.”

But while I couldn’t get that exact number on my smartphone search (a subsequent laptop search revealed 477 million search results), I got something else: Google Gemini’s experimental generative AI response to the question, bereft of irony just like everything else we’ve encountered in this exercise.

You see, according to Gemini, one way to stand out from the crowd is to “be authentic.”

Yes, Google Gemini really said that.

Google search results, including generative AI results.

Now I don’t know about a bot telling me to “be authentic.”

Rodriguez addresses “how” and “why”

Going back to Taylor “Taz” Rodriguez’s post, he had a better suggestion for marketers. Instead of using canned phrases, we should instead create original answers to these two questions:

HOW do you help your clients stand apart from the competition?

WHY have your past & current clientele chosen to work with you?
From https://www.linkedin.com/posts/madebytaz_marketingandadvertising-paidadvertising-socialmediamarketing-activity-7168953109514280960-9H1N/.

Why not “why” and “how”?

Now I know what my Bredemarket groupies are saying at this point.

Only one of these three groupies will survive. (And I shudder to think about what Bredemarket groupies would wear.) By Mike – Flickr: DSC_0657, CC BY 2.0, https://commons.wikimedia.org/w/index.php?curid=26475397

(There aren’t any Bredemarket groupies, but pretend for the moment that there are.)

Taz, “You’re Doing It Wrong™.” Because Simon Sinek insists that “why” is the most important question, “why” should take precedence over “how.”

From https://blog.hubspot.com/customers/3-takeaways-from-start-with-why

To which I respond:

Sinek Schninek.

BOTH questions are important, both need to be addressed, and it really doesn’t matter which one you address first.

In fact, there are some very good reasons to start with the “how” question in this case. It’s wonderful for the marketer to focus on the question of how they stand apart from the competition.

And as a wildebeest lover who grasps a keyboard with my cold dead hands, and with an onboarding process that ensures Bredemarket’s content is the right content for my customers, I can certainly agree with this focus.

Even if my onboarding process does start with “why.”

My “seven questions” as of January 18, 2024. To see the latest version of the e-book on my seven questions, visit https://bredemarket.com/7qs/.

But hey, if you want to address my first two questions in reverse order, go for it.

Find out more here.

Why Knowledge-Based Authentication Fails at Authentication

In a recent project for a Bredemarket client, I researched how a particular group of organizations identified their online customers. Their authentication methods fell into two categories. One of these methods was much better than the other.

Multifactor authentication

Some of the organizations employed robust authentication procedures that included more than one of the five authentication factors—something you know, something you have, something you are, something you do, and/or somewhere you are.

From Krishamurty Pammi, https://krishnamurtypammi-technology.blogspot.com/p/security-management-two.html.

For example, an organization may require you to authenticate with biometric data, a government-issued identification document, and sometimes some additional textual or location data.

From IDmission, https://www.idmission.com/identity-solutions/identity-verification.

Knowledge-based authentication

Other organizations employed only one of the factors, something you know.

Not something as easy to crack as a password.
Instead they used the supposedly robust authentication method of “knowledge-based authentication,” or KBA.

The theory behind KBA is that if you ask multiple questions of a person based upon data from various authoritative databases, the chance of a fraudster knowing ALL of this data is minimal.

From Alloy, “Why knowledge-based authentication (KBA) is not effective,” https://www.alloy.com/blog/answering-my-own-authentication-questions-prove-that-theyre-useless.

Steve Craig found out the hard way that KBA is not infallible.

The hotel loyalty hack

Steve Craig is the Founder and CEO of PEAK IDV, a company dedicated to educating individuals on identity verification and fraud prevention.

From PEAK IDV, https://www.peakidv.com/.

Sadly, Craig himself was recently a victim of fraud, and it took him several hours to resolve the issue.

I’m not going to repeat all of Craig’s story, which you can read in his LinkedIn post. But I do want to highlight one detail.

When the fraudster took over Craig’s travel-related account, the hotel used KBA to confirm that the fraudster truly was Steve Craig, specifically asking “when and where was your last hotel stay?”
Only one problem: the “last hotel stay” was one from the fraudster, NOT from Craig. The scammer fraudulently associated their hotel stay with Craig’s account.
This spurious “last hotel stay” allowed the fraudster to not only answer the “last hotel stay” question correctly, but also to take over Craig’s entire account, including all of Craig’s loyalty points.

And with that one piece of knowledge, Craig’s account was breached.

The “knowledge” used by knowledge based authentication

Craig isn’t the only one who can confirm that KBA by itself doesn’t work. I’ve already shared an image from an Alloy article demonstrating the failures of KBA, and there are many similar articles out there.

The biggest drawback of KBA is the assumption that ONLY the person can answer all the knowledge corrections correctly is false. All you have to do is participate in one of those never-ending Facebook memes that tell you something based on your birthday, or your favorite pet. Don’t do it.

Why do organizations use KBA?

So why do organizations continue to use KBA as their preferred authentication method? Fraud.com lists several attractive, um, factors:

Ease of implementation. It’s easier to implement KBA than it is to implement biometric authentication and/or ID card-based authentication.
Ease of use. It’s easier to click on answers to multiple choice questions than it is to capture an ID card, fingerprint, or face. (Especially if active liveness detection is used.)
Ease of remembrance. As many of us can testify, it’s hard to remember which password is associated with a particular website. With KBA, you merely have to answer a multiple choice quiz, using information that you already know (at least in theory).

Let me add one more:

Presumed protection of personally identifiable information (PII). Uploading your face, fingerprint, or driver’s license to a mysterious system seems scary. It APPEARS to be a lot safer to just answer some questions.

But in my view, the risks that someone else can get all this information (or create spurious information) and use it to access your account outweigh the benefits listed above. Even Fraud.com, which lists the advantages of KBA, warns about the risks and recommend coupling KBA with some other authentication method.

But KBA isn’t the only risky authentication factor out there

We already know that passwords can be hacked. And by now we should realize that KBA could be hacked.

But frankly, ANY single authentication can be hacked.

After Steve Craig resolved his fraud issue, he asked the hotel how it would prevent fraud in the future. The hotel responded that it would use caller ID on phone calls made to the hotel. Wrong answer.
While the biometric vendors are improving their algorithms to detect deepfakes, no one can offer 100% assurance that even the best biometric algorithms can prevent all deepfake attempts. And people don’t even bother to use biometric algorithms if the people on the Zoom call LOOK real.
While the ID card analysis vendors (and the ID card manufacturers themselves) are constantly improving their ability to detect fraudulent documents, no one can offer 100% assurance that a presented driver’s license is truly a driver’s license.
Geolocation has been touted as a solution by some. But geolocation can be hacked also.

In my view, the best way to minimize (not eliminate) fraudulent authentication is to employ multiple factors. While someone could create a fake face, or a fake driver’s license, or a fake location, the chances of someone faking ALL these factors are much lower than the chances of someone faking a single factor.

You knew the pitch was coming, didn’t you?

If your company has a story to tell about how your authentication processes beat all others, I can help.