Biometrics in Pharma: Politics and Privacy Daniel Shapiro * and Sidney Shapiro + * School of Information Technology and Engineering, University of Ottawa + Department of Political Science, Laurentian University

Overview 1.Prescription of Controlled Substances 2.Trends in Google Searches, News, Regions 3.Spam and Other Marketing 4.Biometric Prescriptions: Practical, Political, and Privacy Issues 5.The Impact of Technology 6.Conclusions

Prescription of Controlled Substances The Drug Enforcement Agency (DEA) has announced the implementation of the use of both computerized and biometric security protocols in the electronic prescription of controlled substances. Electronic prescriptions which were up until this point not allowed to be prescribed by electronic means will now be easier for physicians and the DEA to monitor and prescribe.

USA Google Searches Raw Data with ±5% ErrorTrends Pharmacy searches ↑ Prescription, privacy searches ↓ Implication is ↑ use of illegal online pharmacies in the USA In 2004, ¼ of Americans had looked online for drug information, and four percent purchased drugs online [Fox04]

Breakdown by Region

News Coverage in USA Raw Data with ±5% ErrorTrends News coverage of privacy and prescriptions is ↑ News coverage of pharmacy is ↑ too “Prescription drugs online” 2004 indicates ↑ use of online pharmacies [Fox04] pharmacy prescriptionprivacy

Spam and Other Marketing

Biometric Prescriptions: Practical, political, and privacy issues Practical Biometrics Issues: Non-repudiation Improved accountability Delegation prevention Possible increased cost Possible information security concerns False acceptance and false rejection cases Possible serious medical consequences when a drug cannot be obtained due to failed biometric authentication. Political / Privacy Biometrics Issues: RiteAid installs fingerprint scanners in their pharmacies 2004 Less privacy (summarizing data) Policy issues (HIPAA/ETP/PIPEDA/others) Legal issues (selling prescription data) Human factors (fear, misconceptions)

The Impact of Technology Cryptography and Systems Service interruptions due to power failures or DDoS. Biometrics systems would be unable to function without access to communication and information unless the data was stored locally, negating the usefulness of a large scale distributed system. PKI is slow but secure. Biometrics Degraded biometric Combination of several biometrics in order to improve accuracy A certificate authority cannot reissue a biometric. Fingerprint scanners can identify fake fingerprint attempts using sensors to observe the finger temperature, pulse, oxygenation, blood pressure, movement, and electrical resistance.

The Impact of Technology Cryptography and Systems Certificates are preferred over scans due to data size. Digital signatures disallowed in many jurisdictions. Risk-based approach for data encryption. Clearly a prescription for a controlled substance would fall under the category of a high-risk, and would be heavily encrypted. Hardware failure in any component in the system including cameras, fingerprint scanners, barcode readers, and computers. Biometrics Hackers could begin harvesting biometric information from poorly secured e-health system. Setting up a fake service with the express purpose of aggregating biometric information. Sometimes it is cheaper to pay off the bad guys. Biometric software failure due to a bug in the implementation.

The Impact of Technology Cryptography and Systems DEA says you need 2 IDs + biometric. This is like saying you need a biometric + password… Then why use the biometric? As we said earlier, combining certificates reduces false accept/reject. Biometrics A replay attack is a case where a biometric has been copied by a third party and is being used (fraudulently) to authenticate. Picture of a doctor's face in the parking lot, and then displaying the photo to a biometric face scanner. Secure authentication, secure data transmission, cost-effective security, and fast execution of security mechanisms are all highly desirable when implementing biometrics and electronic prescriptions on a large scale.

The Impact of Technology Impact of Artificial "Gummy" Fingers on Fingerprint Systems Tsutomu Matsumoto, Hiroyuki Matsumoto, Koji Yamada, Satoshi Hoshino Graduate School of Environment and Information Sciences, Yokohama National University 79-7 Tokiwadai, Hodogaya, Yokohama , Japan, ABSTRACT Potential threats caused by something like real fingers, which are called fake or artificial fingers, should be crucial for authentication based on fingerprint systems. Security evaluation against attacks using such artificial fingers has been rarely disclosed. Only in patent literature, measures, such as "live and well" detection, against fake fingers have been proposed. However, the providers of fingerprint systems usually do not mention whether or not these measures are actually implmented in emerging fingerprint systems for PCs or smart cards or portable terminals, which are expected to enhance the grade of personal authentication necessary for digital transactions. As researchers who are pursuing secure systems, we would like to discuss attacks using artificial fingers and conduct experimental research to clarify the reality. This paper reports that gummy fingers, namely artificial fingers that are easily made of cheap and readily available gelatin, were accepted by extremely high rates by particular fingerprint devices with optical or capacitive sensors. We have used the molds, which we made by pressing our live fingers against them or by processing fingerprint images from prints on glass surfaces, etc. We describe how to make the molds, and then show that the gummy fingers, which are made with these molds, can fool the fingerprint devices.

Conclusions Online pharmacy popularity ↑ using legal prescriptions Practical, political, and privacy concerns must be addressed in tandem. Market acceptance is possible (RiteAid) Biometric, hardware, cryptographic mechanisms for securing prescriptions are complex

Questions?

References Background image: /2006/11/28/eprescriptions/# /2006/11/28/eprescriptions/#