The Problem With Biometrics at War
An excerpt from "All the Ways We Kill and Die," the forthcoming book by bestselling author Brian Castner.
Illustrations by Shaye Anderson
In 2012, during the American Surge of forces in Afghanistan, a pair of Blackhawk helicopters landed near a walled compound in a river valley north of Kabul, and, against odds, a tall thin young woman from West Virginia named Sarah Soliman got out.
A helmet and body armor hung loosely about her, but beneath she wore a stylish button-down and smart business slacks. She claimed no uniform, carried no gun, lacked all the tactical accoutrements the modern soldier found fashionable. With the confidence of a frequent flier she hopped from the side of the bird, one chunky heel on the ground at a time, and with long steps crossed the LZ of dried mud to where a man from the local Special Forces team was waiting for her.
He was all contrast: unwashed, M4, baggy camo pants, boots, beard. In a spotter's scope they would make quite a matched pair. They greeted each other with comfortable familiarity and hand gestures, few words being possible under the buffet of the blades. At his feet sat six small clear bags filled with blackened junk. He pointed at the bags, hefted one, indicated a white paper report inside each, helped her carry the parcels back to the helicopter, and loaded them on the center jump seat where they would not be lost. The woman reboarded. The man turned his back and returned to his rack in the compound.
The helos never turned off their engines. In a minute they were off, six bags of bomb evidence permanently sequestered from the conventional reporting channels and hand-delivered to the central depths of one of the fiercest intelligence black holes in Afghanistan.
When Soliman arrived back at Bagram, she delivered the six bags to Zac Crush at SOCOM's Improvised Explosive Device exploitation fusion cell. Though they worked for the main SOCOM (Special Operations Command) task force in Afghanistan—in the J2, the intelligence hub for activities as varied as hunter-killer takedowns and local police training—Soliman and Crush were not spooks or Special Forces. They weren't even in the military. They were contractors. Soliman is a biometrics engineer. Crush is an intel analyst in Identity Operations, SOCOM's term for figuring out who people are.
Biometrics is the science of measuring and cataloguing unique human signatures, and it is not a new idea. Scotland Yard adopted fingerprinting in 1901, the New York City police department five years later.
As a system and theory, biometrics is unchanged. To be "enrolled," a citizen simply has their unique characteristics measured. Then, when they want something (a job, to cross a border, access to a military base or classified information), or when the state wants something of them (evidence connected to a crime), those unique characteristics are measured again and checked against a database. Maybe the criminal had applied for a job; maybe the person applying for a job is an ex-con. In the twenty-first century we turn iris patterns into bar codes, use face recognition software, and flip through fingerprints digitally, but the process is fundamentally the same. Only the scope is different; millions of electronic records can be scoured in minutes versus thousands of paper records in days or weeks.
As a biometrics engineer, it was Sarah Soliman's job to implement that scope. She traveled across Afghanistan in order to teach Special Forces units to gather the biometrics data—fingerprints, three photos, iris scans—of every Afghan they met. On the side, she was a courier, carrying forensic IED evidence back to the main SOCOM intel cell, but her prime job was that of the evangelist, selling and teaching a new way to fight the war.
Conducting a census of the population is a classic counterinsurgency strategy. It is also classic counterterrorism, a way to positively identify who needs killing.
The surge in manpower was also a surge in data.
American forces in Iraq used biometrics long before they did in Afghanistan. In 2007, two systems were fielded: the Biometric Automated Toolset and the Handheld Interagency Identity Detection Equipment, known to soldiers in Iraq as BATs and HIIDEs. The BATs used a laptop and heavy scanner and sat at the front gate of every FOB to check any local who wanted access. The HIIDE looked like an old-fashioned bulky digital camera, and could be taken on patrol. This allowed two important developments. First, the entire country could be enrolled if soldiers would serve as door-to-door census takers. Second, when a unit detained someone suspicious, instead of just dousing them in Expray (which would make their hands turn black if they had touched explosives or fertilizer or both), one could immediately scan their eyeballs to find out if they were wanted men.
Afghanistan did not fully adopt biometrics until the next generation of mobile device was fielded. It was called the SEEK, proof that nerds have a sense of humor. It took iris scans and photos and, unlike the HIIDE, FBI standard nail-to-nail rolled fingerprints. "Ten rolled is gold," Soliman would say in her classes. SEEKs were fielded to both Special Forces teams and average Army patrols during the Afghanistan Surge; the surge in manpower was also a surge in data.
The biometrics database was one of the few that was truly DoDwide, and if searched correctly, it could reveal a map of the IED supply chain. The same fingerprints were always found on blasting caps or on the tape inside pressure plates; repeat offenders were the norm. Who applies for a job after emplacing IEDs? Soliman met them all the time. The unemployed, the desperate, the poor, the cuckolded, the cajoled, the ignorant. Computers are magic here, she thought. How can the average Afghan even conceive of a searchable database system of fingerprints and iris scans?
But biometrics could only take you so far. Zac Crush tried to fuse various streams of forensic data and saw the limits every day. He was an analyst in an IED deconstruction office. Compared to the experts working in the big evidence labs in Bagram, Crush had less specific training and had to do multiple jobs, but he produced reports quickly that could be used immediately. This is what he found:
So you have a fingerprint. So what? A fingerprint by itself is useless unless you have records to check it against, and the biometrics database for Afghanistan was always incomplete. And even if you found a match and discovered that a print on a battery in Kandahar in 2012 matched one collected from an individual who applied for a job in Mazer-e-Sharif in 2009, there is very little that can be done at that moment. You know that guy's name, but you don't know where he is now. So you flag his profile in case he randomly pops again. And anyway, all you really know is that he touched a battery. You don't know exactly how he fits into the process. The complete IED network map does not instantly spring into focus once a match is made; it was always fragmented, a concentration of data here, large holes there.
Tracking individual data points is not enough. Soliman's databases sorted through millions of records and set priority lists for the analysts. Crush tied that biometrics info to actual devices. But to move beyond grabbing trigger pullers and tape touchers, to break into the central IED network, an additional level of analysis and ingenuity is required.
In the J2 black hole, such profile-building was the job of contractors like Hayes.
There's a new guy here, Hayes thought. There's a new trainer in town.
Hayes goes by his first name. Part psychologist, part anthropologist, part straight-from-a-police-procedural detective, Hayes was trained in multiple types of intelligence collection. He did biometrics and sensors and detainees as well as traditional targeting and analysis. Eventually, Hayes realized his whole process was built on so many false assumptions, he thought it was amazing they found anyone at all.
Take, for example, the simple idea of names.
In America and the West, everyone has a unique name and it is generally permanent. The biometrics database of fingerprints and iris scans and photos must be organized into records, and those records are identified by the individual's name. Iraq's naming system was generally stable, secular, and Western, and so biometrics fit fairly well.
Afghanistan's naming convention, on the other hand, is fluid and repetitious. Hayes found that the same individual might have multiple public names, depending on his relationship to the person asking. The name might change throughout a life as the person changes. These weren't criminal aliases, but rather natural shades on a theme. The same name could be spelled many ways, often by the same individual. This system works because Afghans know the personal history of everyone in their village, and each person's current name is easily and intuitively understood. Even if the infantry grunt entering the name in the SEEK spelled it right, it was a temporary name alone.
Hayes saw that he was checking fingerprints against a database as impermanent as last winter's snow. But there were so few other means to collect intelligence. Analysts used to be able to rely on signals intelligence, intercepted radio communications. They called it SIGINT Crack, because it was so addicting and easy to use and exploit, but it was a crutch, covering up for a lot of bad methodology and lesser analysis. The enemy in Iraq and Afghanistan had learned to guard their communications, and the good old crack days were now long gone.
Often, Hayes knew, the biometrics was the best they had, the only objective link between individual and bomb.
On one tour, while Hayes was an analyst in the J2, Kunduz province in northern Afghanistan exploded like a pressure cooker heated on the stove too long. Every measurable toll spiked: deaths, injuries, gunfights, IEDs. The lethality of each IED suddenly leapt as well, and new designs were seen throughout the district.
There's a new guy here, Hayes thought. There's a new trainer in town.
In the J2, the analysts called him the So-Called Expert. But despite the name, an expert he was, and respected. Hayes knew that bad bomb makers didn't live long enough to have the kind of impact he was seeing.
In his databases, Hayes's profile for the man was thin. He didn't have fingerprints or an iris scan or a photo or even a name. Of course, his Afghan name might be evolving as well. Hayes only had one firm hit. A series of fingerprints in the hot glue used to attach carbon rods to wooden pressure plate boards. Mohammed from Kunduz. Not Mohamed or Muhammad. Three M's and an E. Good luck finding just one Mohammed in Kunduz, Hayes thought, here's the phone book. But this one had previously applied for a job down south, so they had a name and a face to match to the glue on fifteen IEDs. Thank God for the photos. Without those it was almost impossible to pick up the right guy.
Hayes took the reports to his commander. This was a place to start, Hayes said. We start with Mohammed, and we work our way up. They should do a targeted data collection, Hayes said. Verify or enroll everyone living within a few klicks of every IED bearing Mohammed's hot glue.
In a case like this, it would be Sarah Soliman's job to get on a helicopter and link up with the local Special Forces team. She would deliver new SEEKs and software and repair equipment and train them to cast the wide net, enroll every villager and dirt farmer throughout the valley.
Because that's the funny thing about using biometrics. The only way to find one person is to find everyone.
All the Ways We Kill and Die is available March 1. Reprinted courtesy of Arcade Publishing.