Israel’s biometric program no longer justified, says cyber directorate
An Israeli government biometric program established in the wake of October 7th is no longer justified, according to the National Cyber Directorate.
Following the Hamas invasion and massacre of Israelis on October 7, 2023, Israel’s Knesset (Parliament) passed an emergency law requiring anyone applying for an ID card or passport to submit fingerprints in addition to a facial image. It also granted security agencies and law enforcement unprecedented access to taxpayers’ private biometric data without oversight. Although the stated claim of the program was to help security forces identify the bodies killed in the attack, it remains in effect nearly 15 months later. In November, the Ministry of Public Security requested a renewal of the emergency order.
But according to a recent report from the National Cyber Directorate — a government agency that oversees cyber defense in the civilian sphere — the regulations are no longer justified. The directorate’s Naama Ben-Zvi told Calcalist that security agencies used the fingerprint database to identify just 106 out of 1,205 victims, or about 11%.
“That doesn't mean they couldn't have been identified by another method," said Ben-Zvi. "The police used a variety of models and methods. They used DNA, dental information, other unique marks, and they also used other fingerprint databases. For example, the IDF's biometric database, which is intended only for identifying fallen and missing persons, was not deleted and includes fingerprints, undeciphered DNA samples, and dental information on 3 million Israelis who enlisted. There were also requests to entities abroad for information, and dentists volunteered photographs of victims.”
Ben-Zvi said Israeli citizens should no longer be compelled to submit fingerprints, though she did not object to ongoing facial image requirements.
“Taking fingerprints from the entire population infringes on privacy,” she explained.
Direct access without oversight
Until the massacre, biometric data belonging to Israeli citizens were stored in a database operated solely by the Interior Ministry’s Biometric Database Management Authority. If the Israel Police, Israel Defense Forces, or the internal security agency Shin Bet wanted to confirm the identity of a private citizen, the law only allowed the agencies to submit biometric data to the Biometric Database Management Authority for identity verification. The agencies had no direct access to the database.
For example, police could submit a photo of a person of interest to the Biometric Database Management Authority, which would use facial recognition software to run it against the database’s photos. If a match was found, the agency would be provided with the individual’s identity details. The Authority would not, however, be permitted to provide police with the actual biometric data.
Although the Interior Ministry was found to have operated outside the law for seven years by illegally sharing the biometric data of private citizens with anohter, unidentified, agency, there was some measure of comfort that at least such a law existed.
But that law changed on November 8, 2023. Citing the October 7th attack, Israeli politicians voted to allow security agencies to obtain taxpayers’ private biometric data without any oversight or monitoring. The law has raised concerns about the possibility of a new national biometric database being independently formed by law enforcement and security bodies.
An intention from the beginning
The emergency order drew fierce opposition from digital rights and privacy groups who maintained the Israeli government’s true intention was to make it permanent.
"During the discussion, it was made clear that the security authorities are interested in making the law a permanent law in the future,” said Zvi Dvir from the Movement for Digital Rights at the time. “The decision that during the period of the temporary order, fingerprints of citizens renewing biometric documentation will not be deleted proves the true purpose of the law.”
