The police in Hesse want to check the identity of officials with the help of biometric procedures. “In order to increase security when querying citizen data in police systems, the use of biometric palm vein scanners for everyday work is currently being tested as part of a pilot project at the police station in Rüsselsheim.”, announced the Ministry of the Interior on August 13, 2020 in Wiesbaden. The reason for the announcement was the start of the Innovation Hub 110 for the Hessian police “innovative IT solutions” should develop.
The background to the procedure is, among other things, right-wing threatening letters that were sent to the persons concerned after inquiries about addresses in police databases. The Hessian police are now aware of 69 such threatening letters, most of which were sent by e-mail, sometimes also by SMS or fax, said Hessian Interior Minister Peter Beuth (CDU) on July 21, 2020. He does not rule out that there is a right-wing network in the Hessian police.
According to the announcement, the vein scanners will be used as a second factor in the authentication of officials. “We take the allegations that have arisen against the police in recent months very seriously. A high level of availability of data also means a high degree of responsibility. The verification of identity using a biometric method with the hand vein scanner is already considered very secure”said State Police President Roland Ullmann.
According to Ullmann, after recognizing their palm vein biometrics, the officers must enter their individual identification again in the police information system (Polas). “With this two-factor authentication, we want to achieve the greatest possible security when querying data without restricting the workflow in everyday work too much”said Ullmann. Five palm vein scanners including software for recognizing, storing and authenticating the data are already in use at the police station in Rüsselsheim and will be tested in real operation by the end of the year.
In order to prevent unauthorized queries, the Hessian police have introduced stricter control mechanisms since December 2018, according to the notification. These included random sample controls independent of the occasion, naming the reason for the query for each query and a more in-depth review of every 50th query in the Polas. In addition, would “All individual access authorizations for the entire Hessian police are reset and reassigned every three weeks”. The police lock screens were already activated after three minutes of inactivity and every police officer in Hesse had to log off his computer when leaving the room.
The safety of hand vein scanners is, however, contested by experts. The security researchers Jan Krissler alias Starbug and Julian Albrecht had already demonstrated at the hacker congress 35C3 in Leipzig in December 2018 how dummies can be created with simple means. A well-exposed photo of a hand or a finger, a laser printer and some beeswax, according to the hack, that’s all it takes to bypass vein recognition systems.