OPM hack's unprecedented haul: 1.1 million fingerprints

July 10, 2015 | CNN Money
This is extremely sensitive information, especially as we increasingly use biometric scanners on phones and computers.

This could be one of the potentially worst parts of the Office of Personnel Management hack affecting 21.5 million people. Whoever has this information -- U.S. intelligence thinks it's likely China -- could use the stolen fingerprints to better spy on America. "It's across federal agencies. It's everybody," an OPM spokesman told CNNMoney on Friday.

In a Mission Impossible-type scenario, the thieves could create physical copies using latex or similar materials, then break into the fingerprint-locked devices of U.S. diplomats and government agents. This would expose secret conversations, disrupt investigations or poison international negotiations.

And potentially worse, these stolen records could unmask undercover investigators masquerading as other people. "They're completely compromised," said biometrics expert Ramesh Kesanupalli. "A secret agent's name might be different. But they'll know who you are because your fingerprint is there. You'll be outed immediately."

Kesanupalli has given fingerprints a lot of thought. He created something called the FIDO protocol, a safe way to use the human body to unlock devices. And now he wonders if this collection of 1.1 million stolen fingerprints will end up on the black market. It would create a brand new type of trafficked stolen good: biometrics. That's worse than exposed Social Security numbers. Those can be replaced.

"It's not like they have someone's password. Fingerprints are data that doesn't change. They'll never change. Twenty years from now, this will still be useful," said Robert M. Lee, co-founder of cybersecurity software maker Dragos Security. Cybersecurity experts are trying to make fingerprints even harder to duplicate.

Karl Weintz, who leads the biometrics company Sonavation, said his firm is creating a biometric fingerprint that uses ultrasound to scan 5 millimeters deep, mapping bone structure, blood vessels, and even nerve endings.

At this point, it's difficult to determine how detailed and exact the stolen records are. Some federal agencies use classic ink-on-paper, while others use high-resolution digital scans. OPM couldn't immediately determine how all 1.1 million records were stored, but the stolen batch does include fingerprint records going to back to 2000, when ink images were regularly used.

"They have the most secure keys for people who are interesting enough for OPM to get fingerprints of," said Jonathan Sander, an executive at cybersecurity firm STEALTHbits. "What locks can these guys open? That's the question."

Fingerprints give away more than identity

May 08, 2015 | Science News
The one-of-a-kind pattern of ridges and valleys in a fingerprint may not only betray who was present at a crime scene. It may also tattle about what outlawed drugs a suspect handled.

With advanced spectroscopy, researchers can detect and measure tiny flecks of cocaine, methamphetamine and heroin - in some cases as little as trillionths of a gram - on a lone fingerprint. The study, led by researchers at the National Institute of Standards and Technology in Gaithersburg, Md., appears May 7 in Analytical Chemistry. 

Using an ink-jet-printed array of known quantities of drugs, researchers calibrated their spectroscopy techniques to measure specks of the chemicals. Then, using a 3-D printed plastic finger and a synthetic version of finger oil, researchers created drug-tainted fingerprints pressed onto paper or silicon. 

On paper, the researchers detected as little as 1 nanogram of cocaine and amounts above 50 nanograms of methamphetamine and heroin. On silicon, the method picked up as little as 8 picograms of cocaine and heroin and around 1 nanogram of methamphetamine.

Researchers could also point to the location of the drugs on the fingerprint— at the peaks or dips of the pattern, for instance. Such information, the authors say, could help investigators finger what chemicals a suspect handled first and help corroborate a timeline of events in a crime.

Altered Fingerprints: A Challenge to Law Enforcement Identification Efforts

May 05, 2015 | FBI
For almost a century law enforcement agencies have used fingerprints to identify individuals. Offenders try to defeat fingerprint identification measures in an attempt to hide criminal records, including related deportations. They employ a variety of techniques in their efforts to thwart law enforcement. However, no matter what method they use, their motivation is the same.

FBI fingerprint examiners have encountered situations where criminals, including those in the country illegally, intentionally altered their fingertips themselves or with the assistance of medical professionals. They falsely believed that doing so would prevent law enforcement officials from discovering their true identities.

In 2014 the FBI's Criminal Justice Information Services (CJIS) Division conducted a study of altered fingerprint records maintained in its Integrated Automated Fingerprint Identification System (IAFIS), which became the Next Generation Identification (NGI) System on September 7, 2014. FBI fingerprint examiners isolated 412 fingerprint records in IAFIS that maintained indicators of deliberate print alteration. A review of those records for patterns and trends revealed that Massachusetts officials had the most encounters with individuals who had altered fingerprints, followed by New York, Texas, California, and Arizona 

A substantial number of individuals who altered their prints were arrested for drug-related offenses, followed in measure by immigration-related offenses, theft, and violent crimes. Nearly all of the individuals with intentionally altered prints had extensive criminal records and various law enforcement encounters. Many were deported criminals who altered their fingerprints in an attempt to reenter the United States.

The CJIS Division categorized the alteration types based upon the suspected method used to mutilate the fingerprint. The alterations most frequently encountered were the vertical cut or slice, followed by the z-pattern cut, intentional burns, and unknown or uncategorized.

The vertical cut or slice modifies the fingerprint by scarring or distorting. Individuals cut down the middle of the fingertip, leaving a fairly straight cut on the fingerprint. In some instances an individual will pull the skin near the cut in different directions in an effort to generate an unusual fingerprint pattern when the fingertip heals.

The intent of the z-pattern cut is to scar and distort the natural fingerprint into an unnatural pattern. As with the vertical cut or slice, individuals cut the fingertip; however, in this case they cut a z-shaped pattern.

Using a heat or chemical source to burn the fingertip, the burn method is intended to scar or obliterate the print. If the affected area is small, fingerprint examiners can use other areas of the fingers that contain sufficient prints to attempt to establish identity.

Suspects associated with an unknown method of alteration use a variety of techniques. They may bite or use sandpaper to eliminate fingerprint ridges necessary for identification. As such, law enforcement personnel should record as much detail of the finger as possible, including areas below the first joint.

When law enforcement agencies report altered fingerprints, they help CJIS significantly improve the knowledge base of print alterations and ensure a high rate of identification accuracy. The CJIS Division works with all levels of law enforcement to maintain an awareness of fingerprint modifications and improve measures for identification. Prior to submission, if the person taking the prints notices anything unusual with an individual’s fingers or fingerprints or if the print submitted is returned as an error, the fingerprinter should make a visual inspection of the print and contact the CJIS Division.

The Law has Failed, Not Forensic Science

February 28, 2015 | Science 2.0
It's quite revealing that Karen Kafadar and Anne-Marie Mazza (LiveScience Op-Ed on February 24, 2015, titled "Using Faulty Forensic Science, Courts Fail the Innocent") demand more research in forensic science while ignoring one of the most significant studies on forensic science and erroneous convictions ever conducted.  

In 2012, Dr. Jon Gould at American University published what is perhaps the most comprehensive study on the causes of erroneous convictions. By reviewing case records and data associated with scores of overturned convictions, Gould and his team identified ten critical factors, which if present, are most likely to predict the possibility of erroneous convictions.

By far, the most risky scenario identified by Gould were cases having young defendants with existing criminal records. Other factors related to prosecutorial and investigative tactics, as well as bad lawyering by defense attorneys in representing their clients.

At the bottom of Gould's list, however, was faulty forensic evidence.  

Gould's study did not receive much fanfare at the time of its publication. And, ironically, with so much federal attention paid towards improving forensic science, Gould’s explanation that forensic science malpractice is not a compelling factor leading to erroneous convictions has yet to shape the national conversation about forensic science. 

Why? Because Gould's results conflict sharply with a fabricated narrative constructed by frustrated defense attorneys, grant-seeking academics, and justice reform activists who’ve gone largely unchallenged.  

And because this fictional narrative has twenty-years of rhetoric and political activism behind it (it began with O.J. Simpson's acquittal and its kick-starting of the innocence movement), it has produced an unprecedented federal bureaucratization of forensic science reform initiatives – initiatives from which Kafadar, Mazza, and others in similar positions stand to enjoy considerable benefits and funding.  

Make no mistake, the 2009 report by the National Academy of Sciences, as well as the National Commission on Forensic Science (NCFS), both referenced by Kafadar and Mazza, became institutionalized animations of the fictional narrative. For example, the NAS report on the state of forensic science in the United States was profoundly one-sided and ignorant of critical research that had been done in all forensic disciplines. Worse, not once did the NAS report explore or recognize the significance of international based ISO accreditation in helping to improve how forensic science is practiced and managed.

And now, the National Commission on Forensic Science (NCFS), despite the best efforts of is vice-chairs, Nelson Santos and John Butler - both highly regarded forensic science professionals, seems to languish in arm-chair pondering of legal technicalities and feigned outrage over exaggerated judicial grievances that distract some of its more influential members from addressing the most serious, existential challenges faced by forensic science professionals in the United States.  

Too many forensic science laboratories today cannot afford to pay their scientists. They struggle to attract and retain the most qualified candidates for forensic science positions. Some laboratories are holed up in outdated facilities that were never intended to be used as laboratories.

Yet just when leaders in the forensic science community find themselves on the cusp of getting help, their efforts are hijacked by legal reform specialists and willing accomplices who quickly shift the conversation from helping forensic science to blaming it. That is precisely what happened with the creation of the NAS committee on forensic science, which forensic science leaders in the American Society of Crime Laboratory Directors pleaded the federal government to create in an effort to identify the "needs" of the forensic science community. As it turned out, the committee’s final report was a stab in the back.  

If you can imagine a drowning man fighting to stay afloat while attorneys and law professors stand on the beach blaming him for the depth of the water, you can more-or-less understand what forensic science professionals have dealt with for two decades.

The real narrative is this: Forensic science in the United States is remarkably accurate despite its challenges. The chance of randomly selecting forensic test results from the millions performed each year and finding a major error are remote at best. Forensic science is not, by any stretch, a significant cause of erroneous convictions nor a public enemy. Failures do happen from time to time, and sometimes they are very serious. But they historically reveal themselves to be isolated instances of organizational failure, not systemic occupational weakness.

Forensic science is a success story, and it makes our criminal justice system better – by orders of magnitude.

The volume of research and scrutiny that validates the many forensic disciplines used today is overwhelming. But here is the problem. This research has been done for over a century and is not as neatly organized and accessible as many would like. In some instances, it can be improved and expanded. These are legitimate complaints.

Also, Dr. Jon Gould found that the chief culprit in those few instances where scientific evidence improperly implicated a defendant who was later exonerated is the mischaracterization of the evidence in court - much more of rhetorical problem than a technical one.  

In this regard, trial attorneys and judges are as much to blame for this phenomenon as misguided expert witnesses - as Gould explains. During opening and closing statements, for example, prosecutors and defenders have wide latitude to dismiss or embellish scientific evidence to their liking, which usually happens outside the watch of anyone knowing anything about science.  

This is where the National Academy of Sciences got it right. Our system of justice is simply too archaic and adversarial for there to be the kind of insightful analyses of scientific evidence that are needed. It is the practice of law in the United States that is failing, not forensic science.

Forensic science, of course, needs help. It is underfunded, inadequately supported, and misunderstood by attorneys, judges, and elected officials. Since it struggles so mightily to keep pace with the demand for its services, how could it possibly summon the strength to correct the fictional narrative?

It can't.



For questions or service rates, please contact using the form below or e-mail us at

veritas aequitas