Vietnamese government starts collecting biometrics

• Vietnam is set to collect an enormous amount of biometric data from its citizens.
• Security in the system will obviously be paramount.
• The development seems likely to generate whole new waves of crime by bad actors – biocrime.

Biometric data is increasingly used in technological security systems, yet retina scans and voice recognition still call to mind the hi-tech lairs of fictional villains. Face ID seems a lot less glam when you’re trying to pay for a bus ticket with your phone.

In Vietnam, citizens can now expect to give the government a slew of their biometric data, per the request of Prime Minister Pham Minh Chinh. Collection of biometric data will begin in July this year following an amendment to the Law of Citizen Identification passed in November 2023.

The amendment allows the collection of biometric data and record of blood type and other related information.

The Ministry of Public Security will collect the data, working with other areas of government to merge the new identification system into the national database. The new identification system will use iris scans, voice recordings and even DNA samples.

Vietnamese citizens’ sensitive data will be stored in a national database and shared across agencies to allow them to “perform their functions and tasks.” We’re sure the sharing of highly personal data won’t encounter any issues – accidental or otherwise.

Regarding the method of collection, the amended law says:

“Biometric information on DNA and voice is collected when voluntarily provided by the people or the agency conducting criminal proceedings, or the agency managing the person to whom administrative measures are applied in the process of settling the case according to their functions and duties whether to solicit assessment or collect biometric information on DNA, people’s voices are shared with identity management agencies for updating and adjusting to the identity database.”

Well, obviously.

Chairman of the National Defense and Security Committee, Le Tan Toi, has expressed the belief that a person’s iris is suitable for identification as it does not change over time and would serve as a basis for authenticating an identity.

As things currently stand, ID cards are issued to citizens older than 14, and aren’t mandatory for the six to 14 age range – though they can be issued if necessary. The new ID cards will look much the same but undergo several changes, not least the addition of holders’ biometric data.

They’ll incorporate the functions of some other ID documents too, including driver’s licenses, birth and marriage certificates, and health and social insurance documents. All of your personal information stored in the same place… What could go wrong?

Biometric data must be secured

Fingerprints on the ID card will be replaced by a QR code linked to the holder’s biometric and identifying data.

There are roughly 70 million adults in Vietnam, so the task of collecting the huge amount of data from them all will be no mean feat. In case you hadn’t got there yet: security will be paramount. The data on citizens is prime for identity theft; we might expect to see an increase in bad actor activity, including skimming to collect fingerprints from ATM machines.

Technology is always evolving, but it’s not necessarily guaranteed to evolve for the better. A group of researchers from China and America recently outlined a new attack surface, proposing a side-channel attack on the Automatic Fingerprint Identification system: “finger-swiping friction sounds can be captured by attackers online with a high possibility.”

Ensuring that the personal information of Vietnamese citizens is secure at every level is a responsibility the government must be prepared to take on.

There’s also the sticky issue of government surveillance that almost doesn’t bear thinking about. We’ll leave the tinfoil hat within reach.

From airport services to citizen ID…