Andrew Bud, chief executive of iProov, the company behind the NHS app, has floated the idea of using facial recognition for Covid-19 “immunity passports”.

App

The iProov-made NHS app system, for Android and iOS, not to be confused with the in-development COVID-19 app, is a system for use in England that allows users to access a range of NHS services via smartphone or tablet.

The app can currently be used to get advice about coronavirus, order repeat prescriptions, book appointments, check symptoms (against NHS information), view the user’s medical records, register a user’s organ donation decision, and to find out how the NHS uses a user’s data.

Facial Recognition

Users of the app have to submit a photo of themselves from an official document such as their passport or driving license which the app system uses as the basis for facial recognition to enable a user to verify their identity and access NHS services via the app.

Each time the user logs in using facial recognition, the system scans a person’s face using their phone/tablet camera which involves the user seeing a short sequence of flashing colours.

The Basis of an Immunity Passport

In support of a suggestion made previously by Health Secretary Matt Hancock, Andrew Bud, chief executive iProov has suggested that the trusted identity system of the NHS app could provide the basis for an “immunity passport”.

Immunity Passports

According to the Lancet, an immunity passport is a “digital or physical document that certify an individual has been infected and is purportedly immune to SARS-CoV-2” (the disease associated with the 2019 COVId-19 virus).  The idea of an immunity passport is something that has been considered by governments including Chile, Germany, Italy, the UK, and the USA.  An immunity passport could be used to exempt individuals from physical restrictions and could enable them to return to work, school, and daily life.

Issues

While an immunity passport is an option, some of the issues with this idea are that:

– There is no evidence that people who have recovered from COVID-19 and have antibodies are protected from a second infection (as stated by the WHO, April 24).

– A false-positive and an immune status could make that passport holder change their behaviour, despite still being susceptible to infection and able to infect others.

– Artificial restrictions in society could result for those who don’t have an immunity passport, and this could lead to discrimination, inequality, corruption, bias and even to extra costs for those in countries that don’t have access to (free) health care at the point of delivery.

– Immunity passports for some could restrict travel and civil liberties and could even incentivise people to become infected in order to get the benefits that such a passport could bring.

What Does This Mean For Your Business?

All businesses want to provide a safe environment for their staff, their customers, and other stakeholders as we move out of lockdown restrictions where economies still must function in an environment where COVID-19 is still a serious threat.  Whereas an immunity passport sounds as though it could indicate that a person is less of a risk e.g. when accessing services, not enough is known about whether a person can contract the virus more than once, thereby limiting the effectiveness and validity of the system.  Also, it depends upon how rigidly and widely such a system is used as to its effectiveness, and there are clearly many other issues based around discrimination to consider.

Facial recognition on an app however does sound like it could form a trusted base for a system that requires accurate verification.

‘Vishing’, or ‘phishing over the phone’ is on the rise and in this article, we look at vishing techniques and examples, and how to prevent them.

Vishing

The word Vishing is a combination of ‘voice’ and ‘phishing’ and describes the criminal process of using internet telephone service (VoIP) calls to deceive victims into divulging personal and payment data.

Vishing scams to homes often use recorded voice messages e.g. claiming to be from banks and government agencies to make victims respond in the first instance.

The technology used by scammers is now such that voice simulation may even be used in more sophisticated attacks on big businesses.

Vishing Vs Phishing

Phishing attacks can take different forms and can employ different combinations, such emails, bogus websites, and phone calls.  Vishing focuses on using VoIP to complete the scam and this can include using a ‘spoofed’ phone number of a real business or company to add the appearance of authenticity.

Smishing

Smishing uses SMS text messages rather than phone calls to deceive victims into responding.

Selection

Victims are selected using large call lists where little or nothing is known about the target (‘shotgun’ attacks), or where some information is known from sources such as personal data that has come from website data breaches and perhaps from data interception data gathered from phishing and other social engineering attacks. Vishing attacks where some important data is already known by the attacker are referred to as ‘spear vishing’ attacks.

Motivation

The motivation for attackers is, of course, easy money or data which leads to the acquisition of more money, and perhaps use in further attacks on other sites which can give access to a person’s financial and personal data. In the U.S., for example, if attackers already have the first few digits of a Social Security Number, gaining the remaining numbers can give them access to many other sources of funds and data.

The motivation presented by the attacker to the target to make them part with their data is the promise of bogus rewards e.g. prizes and taking advantage of amazing limited offers, the need to avoid a negative outcome, and the need to be helpful/contribute positively to society e.g. in scams whereby a victim is asked to help police/fraud investigations.

In most cases, fraudsters use emotional manipulation, deception techniques and the illusion of limited time (act now) as ways to gain access to personal data. The internet telephone service (VoIP) calls also provide them with anonymity and flexibility that they need to target their attacks.

The Scale of the Problem

The scale of the vishing threat is now huge.  For example:

– First Orion’s 2018 Scam Call Trends and Projections Report showed that nearly 30% of incoming mobile calls were spam calls.

– The “Quarterly Threat Intelligence Report: Risk and Resilience Insights” report from Mimecast researchers warned that in 2020, “voicemail will feature more prominently” in attacks and showed vishing as becoming a likely daily occurrence in 2020.

– Proofpoint’s 2020 State of the Phish report (worldwide survey) found that 25% of workers could correctly define the term.

Examples of Vishing

Popular examples of vishing calls include:

– Calls from banks or credit card companies with messages asking the victim to call a certain number to reset their password.

– Unsolicited offers for credit and loans.

– Exaggerated (almost too good to be true) investment opportunities.

– Bogus charitable requests for urgent causes and recent disasters.

– Calls about extended car warranties.

– Calls claiming to be from fraud officers to (ironically) help people who have recently fallen victim to scams and attacks, asking people for their help in operations to catch fraudsters e.g. by transferring funds to a specified account.

– Calls claiming to be from government agencies e.g. tax office calls offering rebates or warning of an investigation.

– Tech support calls to fix bogus problems with computers.  This method can also use popup windows on a victim’s computer, often planted by malware, to issue a bogus warning from the OS about a technical problem.

– Travel and holiday company calls relating to (bogus) holiday bookings and cancellations.

– Calls relating to insurance e.g. for weddings, holidays, and flight cancellations.

– ‘One ring and cut’ (Wangiri – Japanese) calls where criminals trick victims into calling premium-rate numbers. For example, the fraudster’s system calls a large number of random phone numbers with each ringing once.  If someone calls back (replying to a missed call) they are directed to a premium rate number.

Real Examples

– In May 2018, in the North-East,  vishing calls over a three-week period resulted in the theft of £1Million by fraudsters pretending to be from their victim’s bank saying they were investigating fraudulent activity by staff within the organisation and asking victims to move large sums money into foreign accounts for safe-keeping.  This was coupled with a request that the victim did not report the call for fear of jeopardising the investigation.

– In September 2019 AI voice simulation software was used to impersonate the voice of a UK-based energy company CEO and to thereby make the company transfer £200,000 into the account of the fraudsters.

– In October 2019, Police in Derbyshire warned that scammers had called victims claiming to be “tech support representatives” from Microsoft, telling people there was something wrong with their computer and offering to fix the problem by remote access.

Government Fights Back

Earlier this month (May 2020), Her Majesty’s Revenue and Customs (HMRC) asked UK Internet Service Providers (ISPs) to remove 292 websites exploiting the coronavirus outbreak since the national lockdown began on March 23.

How To Guard Against Vishing

Ways that you and your business can guard against vishing attacks include:

– Don’t trust caller ID to be 100 per cent accurate, numbers can be faked.

– Don’t answer phone calls to unknown numbers, block numbers of spam callers, register your phone number with the Telephone Preference Services (TPS) and report any suspicious spam calls to the Information Commissioners Office (ICO).

– Beware of unsolicited alleged calls from banks, credit card companies or government agencies, particularly those asking to you to call certain numbers and/or change password details. The real organisations and agencies would not make calls of this kind.

– Include phishing, vishing, smishing and other variants with your security awareness training for employees.

– Avoid using a gift card or a wire/direct money transfer, and make sure that there is a policy and process in place for any money transfers that all employees must adhere to, even if the request appears to come from someone within the company.

– Don’t give in to pressure; remember that you can ditch any call at any time, and give yourself the option of looking up the number of the company/agency/organisation that claims to be calling you and calling them back yourself to check.

Looking Ahead

The predictions from security researchers and commentators are that vishing, along with phishing and smishing are set to increase this year, and their success could be helped by the COVID-19 outbreak as people wait and search for information about financial and health matters, details about government payments and help, and details about cancellations e.g. holidays and flights. Companies and organisations need to educate their staff about the threat, while businesses and individuals need to be vigilant and cautious about any unsolicited phone calls, particularly those that offer rewards, create panic or warn of dire consequences, and those that apply pressure.

In addition to questions about the continued use of potentially unreliable and unregulated live facial recognition (LFR) technology, masks to protect against the spread of coronavirus may be presenting a further challenge to the technology.

Questions From London Assembly Members

A recently published letter by London Assembly members Caroline Pidgeon MBE AM and Sian Berry AM to Metropolitan Police commissioner Cressida Dick have asked whether the LFR technology could be withdrawn during the COVID-19 pandemic on the ground that it has been shown to be generally inaccurate, and it still raises questions about civil liberties.

Also, concerns are now being raised about how the already questionable accuracy of LFR could be challenged further by people wearing face masks to curb the spread of COVID-19.

Civil Liberties of Londoners

The two London Assembly members argue in the letter that a lack of laws, national guidelines,  regulations and debate about LFR’s use could mean that stopping Londoners or visitors to London “incorrectly, without democratic public consent and without clear justification erodes our civil liberties”.  The pair also said that this could continue to erode trust in the police, which has been declining anyway in recent years.

Inaccurate

The letter highlights concerns about the general inaccuracy of LFR. This is illustrated by the example of first two deployments of LFR this year, where more than 13,000 faces were scanned,  only six individuals were stopped, and five of those six were misidentified and incorrectly stopped by the police. Also, of the eight people who created a ‘system alert’, seven were incorrectly identified.

Others Concerns

Other concerns by the pair outlined in the letter about the continued deployment of LFR include worries about the possibility of mission creep, the lack of transparency about which watchlists are being used, worries that LFR will be used operationally at protests, demonstrations, or public events in future e.g. Notting Hill Carnival, and fears that the technology will continue to be used without clarity, accountability or full democratic consent

Masks Are A Further Challenge

Many commentators from both sides of the facial recognition debate have raised concerns about how the wearing of face masks could affect the accuracy of facial recognition technology.

China and Russia

It has been reported that Chinese electronics manufacturer Hanwang has produced facial recognition technology that is 95% accurate in identifying the faces of people who are wearing masks.

Also, in Moscow, where the many existing cameras have been deployed to help enforce the city’s lockdown and to identify those who don’t comply, systems have been able to identify those wearing masks.

France

In France, after the easing of lockdown restrictions, it has been reported that surveillance cameras will be used to monitor compliance with social distancing and the wearing of masks.  A recent trial in Cannes using French firm Datakalab’s surveillance software, which includes an automatic alert to city authorities and police for breaches of mask-wearing and social distancing rules looks set to be rolled out to other French cities.

What Does This Mean For Your Business?

Facial recognition is another tool which, under normal circumstances (if used responsibly as intended) could help to fight crime in towns and city centres, thereby helping the mainly retail businesses that operate there.  The worry is that there are still general questions about the accuracy of LFR, its impact on our privacy and civil liberties and that the COVId-19 pandemic could be used as an excuse to use it more and in a way that leads to mission creep. It does appear that in China and Russia for example, even individuals wearing face masks can be identified by facial recognition camera systems, although many in the west regard these as states where a great deal of control on the privacy and civil liberties population is exercised and may be alarmed at such systems being used in the UK.  The pandemic, however, appears to be making states less worried about infringing civil liberties for the time being as they battl

The housing secretary, Robert Jenrick, has said in a speech about safely restarting the housing market that technology such as virtual viewings looks set to play an important part.

Hard Hit Housing

The housing market has been hit extremely hard by the effects of the COVID-19 pandemic and by the measures taken to curb the spread of the virus. Mr Jenrick highlighted how 450,000 property buyers had to put their plans on hold and 300,000 tenancies come up for renewal each month.  Also, the pandemic has meant that people have been unable to move, many people have been forced to take mortgage holidays or have struggled with rent payments and estate and letting agents around the country have been closed. Housing experts are now predicting a sharp drop in house prices this year.

The construction industry also ground to a halt as lockdown measures were introduced.

It is only now that some estate agents and housebuilding firms have begun to reopen as lockdown restrictions have been relaxed.

How Technology Is Helping

Technology is reported to be helping with the restart of the housing and construction industries in several ways including:

– Estate agents being encouraged to conduct virtual viewings rather than in-person visits to properties.

– Digital transformation projects under the Digital Street plan by HM Land Registry that should allow buyers to carry out parts of the property buying process digitally e.g. using blockchain for contracts and signing deeds online.

– The first-ever virtual hearings for the planning inspectorate which Mr Jenrick has said should take place “within weeks”.

– The UK government using video, phones, and computers to vote remotely on debates.

Measures

On 13 May Mr Jenrick announced the following other measures to help get the housing market and construction moving in the right direction again:

– The First Homes programme (later this year) will give a 30% discount on new homes for key workers including nurses and teachers and police officers as well as local first-time buyers.

– The opening of estate agents’ offices and show homes and allowing and removal companies and the other essential parts of the sales and letting process to re-start.

– Allowing house-building sites to apply to extend their working hours to 9 pm Monday to Saturday in residential areas and beyond that in non-residential areas.

What Does This Mean For Your Business?

The pandemic has forced many of those in government, business and other walks of life to use and realise the value of technology in order to carry out what work they can whether it is video conferencing, collaborative cloud-based working platforms, or other tech tools. The fact that aspects of the housing market and planning can be carried out in a ‘virtual’ way provides safe and effective ways to help to get things moving again and is making a positive contribution at an exceedingly difficult time.