During WWII, Morse Code was an indispensable asset that allowed the allies to transmit sensitive information over long distances with great accuracy. However, it contained an obvious, and potentially fatal, flaw — it provided no built in mechanism for identifying the sender of the messages. In order to combat this, U.S. intelligence officers implemented a methodology known as the “Fist of the Sender,” an early system of “behavioral biometrics” that verified the sender’s identity by analyzing subtle, non-replicable and idiosyncratic “typing” patterns of individual users.
While Morse Code and the “Fist” are laughably archaic by today’s standards, the field of behavioral biometrics has rapidly advanced, and companies today utilize complex algorithms and sensors to determine, track, and record not only your actual “typing” patterns, but also:
- the angle at which you hold your devices;
- the exact speeds at which you swipe or scroll on your devices;
- the manner in which you scroll your mouse; and
- which fingers you use to swipe on your touchscreens;
By collecting thousands of data points on an ongoing basis, companies create a digital profile of your individual mannerisms that can be used to determine when someone else has accessed your account. As reported by the New York Times in 2018, The Royal Bank of Scotland detected an imposter when the unsanctioned user scrolled the mouse wheel and used the numerical strip on the keyboard (both actions that the account holder had never done).
But as this exciting technology inevitably evolves and industries possess eerily accurate behavioral profiles of their clients, what may the legal/constitutional ramifications be?
- Will, for example, this kind of information be admissible in court for the purposes of identification?
- Will companies be limited as to how they can manipulate or sell this kind of data?
- Will police need a warrant to obtain behavioral biometric data from companies, in light of the recent Supreme Courts recent decision in Carpenter v. United States — and to what degree is this data being “voluntarily” transmitted to third parties?
- Will courts eventually determine that such an accurate and nuanced profile of one’s idiosyncratic behaviors are so intimate as to constitute intellectual property belonging to the individual and not the organization collecting it?
- How useful will this information be in creating your robot clone? (I digress)
Our legal system is brilliantly designed to play “catch-up” with an evolving society, but rapid advances in technology, such as behavioral biometrics, will undoubtedly challenge our fundamental understanding of established legal principles in a manner that might even make our Founding Fathers say “new phone, who dis?”