A/HRC/13/37 Rapporteur is particularly concerned about cases where biometrics are not stored in an identity document, but in a central database, thereby increasing the information security risks and leaving individuals vulnerable. As the collection of biometric information increases, error rates may rise significantly.34 This may result in the wrongful criminalization of individuals or social exclusion. Meanwhile, unlike other identifiers, biometrics cannot be revoked: once copied and/or fraudulently used by a malicious party, it is not possible to issue an individual with a new biometric signature.35 In this context, it has to be noted that, contrary to its scientific objectivity, DNA evidence can also be falsified.36 25. Centralized collection of biometrics creates a risk of causing miscarriages of justice, which is illustrated by the following example. Following the Madrid bombings of 11 March 2004, the Spanish police managed to lift a fingerprint from an unexploded bomb. Fingerprint experts from the United States Federal Bureau of Investigation (FBI) declared that a lawyer’s fingerprint was a match to the crime-scene sample. The person’s fingerprint was on the national fingerprint system because he was a former soldier of the United States. The individual was detained for two weeks in solitary confinement, even though the fingerprint was not his. Examiners failed to sufficiently reconsider the match, a situation that was made worse for him when it was discovered that he, as a lawyer, had defended a convicted terrorist, was married to an Egyptian immigrant, and had himself converted to Islam.37 (c) The circulation of secret watch lists 26. Another available technique is watch-list monitoring. The most common type of watch-list monitoring is the “no-fly/selectee” list. Such lists are circulated to airlines and security officials with instructions to detain and question any passenger with a certain name. Little is known of the extent to which these lists are being used, but where these systems are publicly overseen, a number of errors and privacy concerns have arisen, particularly in the United States38 and Canada.39 Data integrity issues remain, as the lists have to be continually checked for errors and the identification processes must be performed with great care. These lists are frequently kept secret as they could tip off suspected terrorists, but at the same time this secrecy gives rise to problems of individuals being continually subject to scrutiny without knowing that they are on some form of list, and without effective independent oversight. Such secret surveillance could constitute a violation of the right to privacy under article 17 of the International Covenant on Civil and Political Rights. 27. Where terrorist lists have been made public, article 17 of the Covenant is triggered in another form. The Human Rights Committee has concluded that the unjustified inclusion of a person on the United Nations 1267 Committee’s Consolidated List constituted a violation of article 17. It considered that the dissemination of personal information 34 35 36 37 38 39 GE.09-17804 See, for example, M. Cherry and E. Imwinkelried, “A cautionary note about fingerprint analysis and reliance on digital technology”, Judicature, vol. 89, No. 6 (2006). See E. Kosta et al., “An analysis of security and privacy issues relating to RFID enabled ePassports”, International Federation for Information Processing, No. 232 (2007), pp. 467–472. See, for example, D. Frumkin et al., “Authentification of forensic DNA samples” Forensic Science International: Genetics (17 July 2009). See the United States Department of Justice, Office of the Inspector General, A Review of the FBI’s Handling of the Brandon Mayfield Case, January 2006. See the United States Department of Justice, Audit of the FBI Terrorist Watchlist Nomination Practices, May 2009. See the Office of the Privacy Commissioner Canada, Audit of the Passenger Protect Program of Transport Canada, November 2009. 11