Tracking how you type, not just what you type

If your phone has fingerprint ID or face recognition for login, you’ve used biometrics for security.

Now we’re at the next step, behavioral biometrics — collecting, recording and analyzing how you type and the gestures you make using your phone.

“Interest in the technology has exploded,” Neil Costigan, CEO at Swedish security company BehavioSec, which holds a patent in the behavioral biometrics, told TechRadar.

Behavioral biometrics uses sensors already in devices, such as the accelerometer and gyroscope in a phone, to measure and record a user’s behavioral pattern, according to Malwarebytes labs. That might include the way and angle at which you hold your smartphone, move your mouse or swipe your finger on a tablet screen.

Software that uses machine learning analyzes the collected data to create a profile for the user. This profile would then be used to continuously check against a user who is in an online banking session, for example.

Some vendors of behavioral biometric tools have amassed profiles on tens of millions of people. One such vendor, Forter, told The New York Times that its database has profiles on 175 million people.

One of the big advantages of behavioral biometrics is that it can validate your identity, not just at logon, but constantly during your use.

So, for example, if someone got into your computer and used your banking software, the bank could tell right away it was not you. Another big advantage is that the user does not know this monitoring is taking place and it requires no additional hardware or software.

Currently, banks and big retailers are the primary user of behavioral biometrics. But its use is expanding.

The Department of Defense is funding a project to develop an identity verification method based on the capture of behavioral biometrics by a smartphone, according to NextGov.com

Of course, whenever your data is being collected and stored, there are privacy concerns.

“What we have seen across the board with technology is that the more data that’s collected by companies, the more they will try to find uses for that data,” Jennifer Lynch, a senior lawyer for the Electronic Frontier Foundation told The New York Times. “It’s a very small leap from using this to detect fraud to using this to learn very private information about you.”

All but three states — Illinois, Texas and Washington — allow the collection and analysis by employers or consumer companies of any biometric information without any type of disclosures, according to the California Employment Law Report.

In most countries, including this one, there are no federal laws governing the collection and use of biometric behavioral data. Even Europe’s tough new privacy rules have exemptions for security and fraud prevention.

A new digital privacy law in California, which includes behavioral biometrics on the list of tracking technologies that companies must disclose, does not take effect until 2020.

So now not only what you type, but also how you type, is being stashed away.