National Security Risks Associated with the Strava App

The Strava App story seems to have mesmerised readers worldwide. Understandably so. People as sensors is a concept that has gathered momentum in the fields of location-based services, social media and crowdsourcing applications. In 2003, I recognised the potential of GPS/GIS and ran a study titled Spatial Database National Australian (S-DNA) that was funded by the University of Wollongong. Here are some of the first outcomes of the work, that later grew to be funded by the Australian Research Council as a Discovery Project:


The Capability on SBS Greek Radio

Your face is becoming the latest weapon in the world of digital surveillance, and the humble driver's licence looms as a game-changer in tracking individuals through both the real and virtual world.

In Mandarin:




科技和法律方面的专家卡蒂娜·迈克尔(Katina Michael)教授说,在全国可访问的数据库中,大约50%的人已经存储了视觉化的生物特征,而驾照的引入会将这个比例一下提升到80%。




斯蒂芬·威尔逊(Stephen Wilson)经营着一家咨询公司,负责研究和跟踪企业与政府领域的生物识别技术趋势。



威尔逊说,“ 我们在电子数据库里曝光得越多,我们被以生物识别特征匹配的可能性就越大。另外,对试图犯罪的人来说,想要伪造一个驾照,可以从系统里找到一长串与他们长相相似的照片来选择”。

生物识别技术研究所(Industry Trend Tracker)的年度行业调查显示,面部识别将是未来几年最有可能增加的生物识别发展趋势。


Biometric data from driver's licences added to government database

your face used to track you by government.jpg

Your face is becoming the latest weapon in the world of digital surveillance, and the humble driver's licence looms as a game-changer in tracking individuals through both the real and virtual world.

Experts warn your biometric data may already be vulnerable to misuse by criminals and terrorists, as the proliferation of mobile cameras combined with social media and ubiquitous CCTV feeds mean we're caught on screen more than ever before.

Key points

  • Biometric data builds an online profile using your photo, age and address
  • This can then be matched against photos gathered from the internet or CCTV
  • The data can be used by government agencies, along with companies and criminals

Driver's licences will be added to the Commonwealth Government's already vast biometric databases after it struck an agreement with the states and territories, handing authorities access to an unprecedented level of information about citizens.

A system known as "the interoperability Hub" is already in place in Australia, allowing agencies to take an image from CCTV and other media and run it against a national database of passport pictures of Australian citizens — a process known as "The Capability".

But soon driver's licences will be added to the system, allowing both government and private entities to access your photo, age and address.

It is a $21 million system being sold as a way to tackle terrorism and make commercial services more secure.

But experts warn people now risk losing control of their biometric identity entirely as commercial interests, governments and organised crime gangs all move to capture more personal metadata for their own gain.

Driver's licences change the biometric game

Technology and legal expert Professor Katina Michael said about 50 per cent of the population already had some kind of visual biometric stored in a nationally-accessible database, but the inclusion of drivers licenses would see the proportion of Australians scooped up in the net swell to about 80 per cent.

She said one of the biggest risks of the collection of biometric data was not deliberate misuse by the AFP, ASIO or another government agency, but rather vulnerabilities in the way biometrics work.

Who can access your biometric data?

Document Verification Service (DVS) - government and private sector

  • Companies and government can run an identity document through a database to see if it matches information held on file, and that the document has not been revoked
  • Individual must consent before DVS used

Face Verification Service (FVS) - government and private sector

  • Enables a facial image of an individual to be compared against government records of that same individual, such as passports and drivers licences
  • Individual must consent or a legislative basis must be established to collect the information, and use must comply with the Privacy Act

Face Identification Service (FIS) - only law enforcement agencies can use

  • A facial image can be compared against multiple facial images held on a government database, including Australian citizens' passport photos and now driver's licences.
  • Multiple records of people who have a close match to the image are usually returned
  • An agency must have a legislative basis or authority to collect and use the information
  • Access is restricted to law enforcement agencies or those with national security related functions

"It's not like a one-on-one match, where you put (in) an individual's face and say: 'they're a suspect'," Professor Michael said.

"But rather what you get returned is a number of possibilities … you might get back 15, or 20, or 30, or 50 matches.

So you might have 50 innocent people being suspects, rather than the person that you're trying to catch

Professor Michael said this meant that while over time a person's name might be cleared, their data could remain in a database linked to a criminal investigation.

"And then I'm thinking, what happens to their level of innocence as time goes on, because they accidentally look like a minority group?" she said.

She said real criminals and terrorists would opt out of the system, choosing not to have passports and driver's licenses in a bid to escape the net.

"Of course, if you've done nothing wrong, the old adage says you're fine. But increasingly, we don't know if we're fine," she said.

The rise of 'uberveillance'

Professor Michael said modern surveillance methods employed by law enforcement were not just limited to CCTV — they now incorporated vast amounts of metadata and social media, leading to a concept known as "uberveillance" in which people were constantly monitored.

"What we have now are digital footprints that we all leave behind," she said.

"Phone call records, internet searches, credit cards and even the data on your electronic train or bus ticket can be used to track your movements and activity.

"It brings together all these various touchpoints, telecommunications records, travel data via tokens, facial recognition on federal databases, your tax file number … that's accessible depending on the level of crime and social media.

"You've got this very rich almost cradle-to-grave kind of data set that's following you."

We asked if you were concerned about driver's licenses being added to a biometric database.


Organised criminals want your identity

Stephen Wilson runs Lockstep Consulting, a Sydney-based firm which researches and tracks trends in biometrics in the corporate and government spheres, and advises clients on best-practice.

He said at the moment very secure biometric systems took quite a long time to process images accurately.

Problems arose when consumer convenience, such as being able to unlock a phone or access a bank account with a quick face or fingerprint scan, trumped security.

"No police force, no public service, no business is ever perfect, there is always going to be corrupt people," Mr Wilson said.

"The more exposure we have to electronic databases, the more exposure we have to biometric matching, it's only a matter of time before these bad actors succumb to temptation or they succumb to corruption and they wind up using these systems inappropriately."

Your biometric twin is out there

VIDEO: Professor says nothing to fear from federal driver's license database (ABC News)

Mr Wilson said biometrics were creeping into consumer services like bank accounts and online betting facilities, with customers asked to send a picture of their licence and a "selfie" that will be run through an identity matching service.

"The real risk is that bad actors will take people's photos, ask for a match, and get back a series of matches of people that are kind of like your biometric twin," he said.

"We've all got doppelgangers, we've all got people in public that look just like us.

"If you're trying to perpetrate a crime, if you're organised crime, and you're trying for example to produce a fake driver's licence, it's absolute gold for you to be able to come up with a list of photos that look like 'Steve Wilson'."

Technology companies like Apple and Samsung have championed the use of biometrics such as fingerprints, and this has taken a step further with facial recognition becoming more common thanks to the release of the iPhone X.

PHOTO: Apple's iPhone X has championed facial recognition technology. (Twitter: AppleEventos)

However Mr Wilson said a key difference was that information stayed on the phone, while banking and other commercial interests trying to use your biometrics to confirm your identity could be storing it on a server anywhere.

"Do you really want your photo, which is a pretty precious resource, sent off to a company perhaps on the other side of the world just so you can get a quick bank account or quick betting service set up?" he asked.

What will happen next?

An annual industry survey conducted by the Biometrics Institute, known as the Industry Trend Tracker, has nominated facial recognition as the biometric trend most likely to increase over the next few years.

Respondents believed privacy and data protection concerns were the biggest constraint on the market, followed by poor knowledge of decision makers, misinformation about biometrics and opposition from privacy advocates.

The Australian law reform commission says biometric systems increasingly are being used or contemplated by organisations, including in methadone programs, taxi booking services, ATMs and online banking, and access to buildings

Dr Michael said governments needed to be very cautious about how they applied this rich new source of data in the future.

She said governments were building these agreements between themselves and corporations in a bid to stamp out fraud, but that goal was not always achieved and the potential for mistakes was vast.

"What we have is this matching against datasets, trying to find the needle in the haystack," she said.

"Often what happens is we don't find the needle."

A statement from the Department of Home Affairs said the Australian Government was exploring making the Face Verification Service available to the private sector, but nothing had started at this point.

It said arrangements for private sector access would be informed by an independent privacy impact assessment and those using it would need to demonstrate their lawful basis to do so under the privacy act and where they had gained consent to use a person's image.


Source: Rebecca Trigger, January 15, 2018, "Experts sound alarm as biometric data from driver's licences added to government database", ABC News,

Reprinted in The New Daily here:

Furthermore, an interview with Professor Brian Lovell from the University of Queensland on the ABC further demystifies facial biometrics and the government's use of The Capability:


Kekhawatiran Semakin Terbukanya Data Pribadi di Era Digital

Kekhawatiran Semakin Terbukanya Data Pribadi di Era Digital

Senin, 15 Januari 2018 11:05 WIB

Wajah kita menjadi alat terbaru dalam dunia pengawasan digital. Dan di Australia kartu izin mengemudi mulai digunakan untuk melacak orang-orang, baik di dunia nyata maupun dalam dunia maya.

Data Biometrik

  • Sistem biometrik adalah mengenali seseorang berdasarkan ciri-ciri fisik, karakter, dan perilakunya
  • Data biometrik menggunakan data pribadi online lewat foto, usia, dan alamat tinggal
  • Data pribadi ini kemudian dicocokan dengan gambar yang terekam CCTV atau foto di internet
  • Data bisa digunakan oleh agen pemerintah, termasuk perusahaan, bahkan kelompok kejahatan

Para ahli memperingatkan data biometrik milik kita mungkin sudah rentan disalahgunakan oleh komplotan penjahat dan teroris, karena maraknya gabungan penggunaan telepon dan jejaring sosial serta adanya kamera CCTV dimana-mana, sehingga kita lebih sering tertangkap kamera.

Kartu izin mengemudi akan ditambahkan ke database biometrik di Australia, setelah adanya kesepakatan dengan negara-negara bagian dan wilayah khusus, sehingga pihak berwenang dapat mengakses informasi soal warga mereka dengan cara yang belum pernah ada sebelumnya.

Sebuah sistem yang dikenal dengan sebutan 'The Interoperability Hub' sudah ada di Australia, yang memungkinkan pihak-pihak berwenang untuk mengambil foto dari CCTV atau media lainnya yang kemudian dicocokkan dengan database foto-foto dari paspor. Proses ini dikenal dengan sebutan 'The Capability.'

Tetapi, setelah kartu izin mengemudi masuk ke sistem database baru, maka pemerintah dan sejumlah pihak swasta dapat mengakses foto, usia, dan alamat Anda.

Sistem ini sudah menghabiskan $21 juta, senilai Rp 210 miliar, sebagai cara untuk mengatasi terorisme dan membuat layanan komersial lebih aman.

Namun para ahli memperingatkan kini warga beresiko kehilangan biometrik mereka sama sekali, karena pihak komersial, pemerintah dan kelompok kejahatan terorganisir berupaya untuk mendapatkan lebih banyak data pribadi demi keuntungan mereka sendiri.

Kartu izin mengemudi jadi sumber data baru

Kartu izin mengemudi di Australia sudah ditambahkan sebagai sumber data biometrik

Pakar teknologi dan hukum, Profesor Katina Michael mengatakan sekitar 50 persen populasi Australia telah memiliki semacam biometrik visual tersimpan dalam database yang dapat diakses secara nasional. Namun dengan digunakannya kartu izin pengemudi akan menyebabkan lebih banyak data pribadi warga yang tersimpan dan membuat jumlahnya naik 80 persen.

Profesor Michael mengatakan salah satu risiko terbesar dari pengumpulan data biometrik adalah bukan penyalahgunaan yang tidak disengaja oleh kepolisian federal Australia (AFP), agen intelijen Australia (ASIO), atau agen pemerintah lainnya, melainkan kerentanan cara kerja biometrik yang rentan.

"Ini bukan seperti Anda memasukan wajah seseorang kemudian mengatakan, 'mereka adalah tersangka'," kata Profesor Michael.

"Tapi yang kita dapatkan adalah sejumlah kemungkinan... mungkin ada 15, 20, 30, atau bahkan 50 kemiripan."

Jadi, yang akan didapatkan bukan satu orang yang akan ditangkap, melainkan 50 orang yang tak bersalah menjadi tersangka.

Profesor Michael menjelaskan ini berarti bahwa meski nama seseorang bisa dipulihkan seiring waktu jika terbukti tidak bersalah, tapi masih ada dalam database yang terkait penyelidikan kriminal.

Orang diawasi secara terus menerus

Teknologi baru bisa memantau dan mengenali wajah orang di kerumunan.

Profesor Michael mengatakan metode pengawasan modern yang digunakan penegak hukum tidak hanya terbatas pada CCTV. Mereka juga sekarang bisa memasukkan sejumlah besar metadata dan jejaring sosial, yang mengarah ke konsep dengan sebutan "uberveillance" di mana orang-orang dipantau secara terus menerus.

"Sekarang kita memiliki 'jejak digital' yang ditinggalkan semua orang," katanya.

"Catatan panggilan telepon, apa yang dicari di internet, kartu kredit, bahkan data pada kartu elektronik kereta atau bus dapat digunakan untuk melacak pergerakan dan aktivitas Anda."

Apa selanjutnya?

Survei industri tahunan yang dilakukan oleh Biometrics Institute, yang dikenal sebagai 'Industry Trend Tracker', telah menyatakan teknologi pengenalan wajah kemungkinan akan menjadi tren biometrik yang meningkat dalam beberapa tahun ke depan.

Para responden survei merasa masalah privasi dan perlindungan data sebagai kendala terbesar, diikuti dengan pengetahuan yang buruk para pengambil keputusan, kesalahan informasi soal biometrik, serta penolakan dari pendukung privasi.

Komisi reformasi hukum Australia mengatakan sistem biometrik semakin banyak digunakan atau dipertimbangkan oleh banyak organisasi, termasuk program rehabilitisi narkoba, layanan pemesanan taksi, ATM dan perbankan online, serta akses masuk ke gedung.

Profesor Michael mengatakan pemerintah harus sangat berhati-hati dalam menerapkan sumber data baru yang melimpah ini di masa depan.

Menurutnya pemerintah sedang membangun kesepakatan antara pihaknya dengan sejumlah perusahaan untuk berupaya menghindari kecurangan, namun seringkali tidak tercapai dan potensi menyalahgunakan sangatlah luas.

"Apa yang kita lakukan dalam mencocokan dengan kumpulan data adalah seperti menemukan jarum di tumpukan jerami," katanya.

Dalam pernyataan Departemen Dalam Negeri disebutkan Pemerintah Australia sedang menjajaki pembuatan layanan verifikasi lewat pengenalan wajah untuk sektor swasta, namun upaya ini belum dimulai.

Disadur dari laporan aslinya dalam bahasa Inggris yang bisa dibaca disini.

Lihat Artikelnya di Australia Plus

Mandatory Data Breach Notification (2017 Amendment to Privacy Act)

Today I had the pleasure to speak to Meredith Griffiths, reporter of the ABC, on the newly enacted Mandatory Data Breach Notification (MDBN) that take effect on Feburary 28, 2018.

Some of the main points I made in the interview with the help of my colleagues at the Australian Privacy Foundation (primarily David Vaile) were:

MDBN doesn't go far enough because:

  1. small business, <$3m annual turnover are exempt from MDBN
  2. self-assessment of "serious harm" is ambiguous (on what test to companies come forward? and only if PC agrees it is serious? what if slightly serious on one view, and very serious on another- do companies take the easy way out and not disclose?)
  3. companies are given 30 days to make a data breach notification to the privacy commissioner (too long for customers to be kept in the dark and thereafter how long might it take the Privacy Commissioner to determine 'seriousness' and/or publicly response with an unenforceable determination)
  4. what about data breaches offshore (how do Aussies respond to loss of their PI abroad)?
  5. what about 'open data' re-identification thru AI/machine learning?
  6. OAIC is overloaded, slow, determinations are also unenforceable and very rare.

So where does this really leave us? We have a law that neither prevents breaches of personal information nor compensate individuals for privacy breaches. What we need to do is consider the outcomes of the ALRC from 2008 that stipulated we need a tort on the serious invasion of privacy so that individuals CAN sue other individuals (like hackers), or companies (like Google) or government agencies for breaches in their privacy (whether accidental or deliberate or through some form of negligence).

The lack of auditability of the new law means that current practices that rely on de-identification to safeguard people's personal information, say in the case of OPENGOV data initiatives, may not be enough down the track as the threat of increases from machine learning algorithms that can look at patterns of information and highlight individuals like finding a needle in a haystack. The issues of going down this path are grave- including the potential for re-identification and bringing several disaparate treasure troves together like social media data, and government data, and personal records together to be analysed.

Links to MDBN include:

Having a statutory tort of serious invasion of privacy (like in the UK and US) or a common law tort (like in New Zealand), allows individuals to sue other entities depending on the severity of the privacy breach. Why is Australia lagging so far behind other advanced digital nations? When will this legislation be amended?

Already, we are seeing large ICT companies set up "shop-fronts" in Australia with NO enforceable penalties to international misdemeanours when it comes to amassing treasure troves of data, and data breaches offshore. How do we hold these companies accountable when they are taking in a lot of business from Australian consumers and yet seem to be let out in the "wild" to do as they please, storing data on the Cloud either in the USA or Ireland. Bruce Schneier called this "data as a toxic asset". As the toxicity rises, we can expect major pollution spills.

For now, at least we can say that the MDBN is a step in the right direction despite that it falls short through exemptions and loopholes. It can have some reputational impact on "data addicts" that don't do the right thing via their subscriber base, but little more. Sadly, large corporations can handle this reputational damage in their "risk appetites". The fines are also "measly" when it comes to government or regulatory action, and so corporate and government entities in particular are left to their own devices here in Australia. While well-meaning, it seems that it is nothing more than a theatrical show- data hosts are still not responsible for bettering their security practices or urgently responding and fixing a breach.

Data is a bit like mental illness. You can't see it. It is not tangible. You cannot put a price on mental health, and you cannot put a price on your personal data. While we can manage damage to property very well, because we can see a scratch on a car, or the loss of inventory, we cannot see data as we see a broken arm.

We already have very weak Privacy Legislation- Australia needs to get serious like Europe (through the General Data Protection Regulation, considered the gold standard) has on the value of personal identifiable information (PII). Both the liberal and labour governments need to listen to the commissioned reports by the Australian Law Reform Commission, and act on the implementation of statutory tort legislation with respect to intrusions of privacy. There is no reason why this has not happened yet.

K5's Experiential Robotics Goes Wrong

The war between robots and humans is heating up

Dr Katina Michael is a professor in the School of Computing and Information Technology at the University of Wollongong. She considers the K5 to be a sinister development and has been following its progress since 2013. She’s notes how they look somewhat like the dreaded Daleks from Doctor Who – without the weaponised arm.

What are you meant to do? Take out your umbrella and start hitting it?
“If you see one coming toward you,’’ says Professor Michael, “what are you meant to do? Take out your umbrella and start hitting it?’’

At trade shows, she’s seen a K5 trip on a buckle in the carpeting and fall over. “The question is when they take a different form in the future…. When they can walk like a human. Then it becomes a different proposition. It doesn’t look so harmless. They’re more mobile. They can be tripped … but get up again.’’

She notes that K5 robots were first trialled by Microsoft and Uber. The Uber connection is significant because the ride-share outfit has disrupted the regulated taxi industry by baldly flouting the law. Surveillance robots are being launched upon us in much the same lawless way.

“It’s autonomous, gathers information and is capable of behavioural analysis. It’s a grave invasion of privacy. They are danger to society because they will develop awareness over time. For the first time we have an autonomous system that can follow humans.’’

Citation: John Elder, December 23, 2017, "The war between robots and humans is heating up", The New Daily,

Further reading:

Journalist seeklibng input for story



John Elder <>

Thu 21/12/2017 11:19 AM

Thank you Katina Hope to catch up again some day John Sent from my iPhone


Mark as unread


Katina Michael

Thu 21/12/2017 10:01 AM


John Elder <>;


Four articles as promised: