Brain waves too revealing for biometric authentication?

As researchers explore more secure ways of authenticating user identity to protect cyber security, one goal is to monitor user identity throughout a session, not just once at user log-in. Measuring brain waves for behavioral authentication (keeping track of a confidence metric throughout a user session) is a hot field of study. However Abdul Serwadda, a cybersecurity expert and assistant professor at Texas Tech University, warns that brain waves can do more than identity someone, they can reveal information most people want keep private.

Brain waves are read with an electroencephalogram (EEG). EEG reading devices are now a commodity item; for $100 you can buy an EEG device to wear on your head similar to a set of headphones. There are already video game apps that can operate using the player’s brain signals. Essentially any bright determined person can now write an app that interprets and operates using brain signals.

The study at Texas Tech, recently presented to the IEEE* International Conference on Biometrics, focused on determining if sensitive personal information such as medical, behavioral or emotional traits could be revealed from a person’s brain waves.

In the study, alcoholism was the trait used for testing. Diagnosed alcoholics and non-alcoholics comprised the test subjects. The result was that researchers reading brain waves were able to identify the trait of alcoholism about 75% of the time. They also determined they could greatly reduce the ability to detect alcoholism with only a slight reduction in the ability to accurately identity an individual.

Currently, the focus of research is to obtain accurate information with the lowest possible error rates. Serwadda would like to see the goal of research refined to be able to access enough information for accurate biometric authentication, while revealing minimal information about a user’s sensitive personal traits.


* Institute of Electrical and Electronics Engineers


Brain waves can be used to detect potentially harmful personal information

Texas Tech University, ScienceDaily Science News article, October 3, 2016

Public Domain Image, source: Christopher S. Baird