Information about computer handwriting: The challenges of finding a balance between individual liberty and state security

Tsvetkova Anna Denisovna ORCID: 0000-0002-1631-9265 Student of the Institute of Justice, Ural State Law University named after V. F. Yakovlev 620034, Russia, Sverdlovskaya oblast', g. Ekaterinburg, ul. Kolmogorova, 54 at@crimlib.info Other publications by this author

In recent years, information technologies have been penetrating our lives at an increasingly rapid pace. In Russia and abroad, they began to talk about the so-called information rights of citizens: the right to be forgotten, the right to determine their "digital identity", the right to access the Internet, etc. ^{[1, pp. 8-31]}. However, any technological development actualizes the problem of achieving a balance between freedom and security: so, on the one hand, many people see computer systems as a means of complete anonymization, creating a fictional identity of a digital profile with the characteristics that the person himself wants to consolidate ^{[2, p. 142]}. At the same time, the number of computer crimes is growing every year, especially if we approach their understanding in a broad, criminalistic sense ^{[3, p. 167]}. This fact is noted not only by the scientific community: for example, at the Russia-Africa Economic and Humanitarian Forum, held on July 27-28, 2023 in St. Petersburg, it was pointed out that domestic information systems are exposed to cyber attacks more often than it happens in other countries. Accordingly, the state is interested in maximum control of the virtual environment. In particular, while preserving the right of users to anonymity, it wants to develop a mechanism for identifying citizens, deanonymizing their identity if such a need arises.

This task is very successfully solved by biometric technologies, which allow, in addition, to increase the level of personal information security by configuring two-factor authentication systems for access to the system ^{[4, p. 49]}. It is their research from the perspective of the prospects of introduction into public life that is the subject of this study.

Biometric technologies are instrumental solutions for processing biometric personal data of a person ^{[5, p. 242]}. In science, the latter are usually divided into static and dynamic (behavioral) ^{[6, p. 2; 7, p. 35; 8, p. 83]}. However, it seems that this approach cannot be fully accepted for use in Russian legal studies. This is due to the fact that Article 11 of Federal Law No. 152-FZ of 27.07.2006 (as amended on 06.02.2023) "On personal data" divides all personal data into biological and physiological. Thus, we will continue to use legally established categories with the caveat that the content of physiological biometric data coincides with dynamic and behavioral data disclosed in most scientific studies on the relevant topic.

Among all biometric technologies in Russia, the most common are those that allow identifying a person by the papillary pattern of the fingers, the image of the face and the iris ^[9]. However, biometrics includes a much more extensive list of identification-significant features ^{[10; 11, p. 14]}, and the current level of technological development suggests the existence of extensive potential for the development of appropriate biometric technologies. In terms of computer crimes, the processing of information about a person's computer handwriting seems to be the highest priority, since all researchers of this phenomenon note its comparative cheapness and simplicity, since fixing does not require expensive equipment ^{[12, p. 64]}.

Let us explain that computer handwriting is a physiological biometric characteristic of a person, combining a set of skills and habits of user interaction with manipulator devices when creating text. The most informative in its structure is information about the specifics of the keyboard set: the pressing force ^[13], the dynamics of input ^{[14, p. 240]}, the printing speed ^{[15, p. 17]}, the duration of the interval between presses ^{[16, p. 583]}, etc.

The purpose of this study is to prove the prospects and acceptability from the point of view of compliance with constitutional norms of widespread technology of identification and authentication of users of computer devices based on information about their computer (keyboard) handwriting. To do this, we used both general scientific and special methods. The most significant of all were: the method of analogy (when projecting the legal regimes of already implemented biometric systems to new technologies), deduction (when projecting the general features of biometric data to individual particular examples), comparative legal (when comparing the legislative regulation of biometric data in different countries), system (to harmonize doctrinal and legal approaches), a modeling method (when designing possible scenarios for expanding the number of biometric technologies used to improve state security), etc.

Computer handwriting can be considered as personal data ^{[15, p. 17]}, which, according to paragraph 1 of Part 1 of Article 3 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data", are defined as "any information relating directly or indirectly to a certain or identifiable individual (subject of personal data)". Moreover, the phenomenon under consideration, which all its researchers primarily talk about, is included in the category of biometric personal data ^{[4, p. 49; 17, p. 583; 18, p. 128]}, which, as noted in the scientific literature based on Article 11 of the said law, have two features: "infirstly, they characterize the physiological and biological characteristics of a person, on the basis of which it is possible to establish his identity, and, secondly, they are used by the operator of personal data to establish the identity of the subject" ^{[19, p. 116]}. At the same time, it is emphasized that biometric personal data can be those information that is directly used for identification, and not only theoretically suitable for it ^{[19, p. 116]}. Information about computer handwriting characterizes the physiological peculiarity of a person and makes it possible to identify a specific carrier, and is also used today at a private level to identify the user of a computer device ^[20-22]. It can be concluded (and this is confirmed by all researchers ^{[10, p. D-116; 23, p. 157; 24, p. 171]}) that computer handwriting is a functional biometric characteristic of a person.

In this regard, the existence of the phenomenon of computer handwriting creates a significant space for research for the science of constitutional law, giving rise to the following questions:

1) is it permissible from the point of view of the constitutional rights of citizens to collect information about their computer handwriting;

2) how should the data on a person's computer handwriting be protected ^{[25, p. 165]};

3) where should information about computer handwriting be stored;

4) should commercial organizations be restricted that are "also interested in collecting and processing personal data in order to create new business models, personalize the goods and services provided, maximize the effective use of innovative technologies in competition, protect their own interests in dispute resolution" ^{[26, p. 74]} (in particular, information about computer handwriting of users is taken as a basis for the development of more convenient, ergonomic keyboards, which creates a competitive advantage in the market of computer components), and how it is possible to implement this restriction, etc.

However, despite the rather long history of research devoted to the phenomenon under consideration, which began in the 1970s ^{[10, p. D-116-D–122]}, the vast majority of works still do not go beyond the computer-technical field of knowledge. Legal studies, if any, ignore, with rare exceptions, aspects of the legal implementation of systems for fixing indicators of computer handwriting (as an exception, the works of I. Z. Fedorov ^[27] can be called, whereas, for example, E. I. Voigel, also touching on the topic of computer handwriting, do not analyze the issue of obtaining information about it from the legal points of view ^{[28, p. 105]}).

The solution of the above issues is the subject area of public and public law sciences – and work in this direction is necessary to create a legally justified opportunity to expand the scope of biometric technologies. In this paper, we will try to lay the foundation for further research in this direction by briefly answering the problematic questions posed. At the same time, we note that they represent only the initial link, but do not exhaust the full depth of this topic.

1. The first question seems to be the most difficult, since it is located not so much within the framework of science as in the sphere of philosophy, stating the eternal dilemma: freedom or security. At the beginning of this article, we have already pointed out this contradiction when considering the use of biometric technologies, now we emphasize the following. In our opinion, constitutional human rights will be more respected if the state begins to centrally collect information about the computer handwriting of persons operating in the virtual space. You can draw an analogy with passport control at airports: security personnel see everything that a passenger is going to take with him to the departure area, but this allows you to prevent terrorist attacks, saving the lives of civilians. The same is true with information about computer handwriting: the information system will receive information about the characteristics of the text typed on a computer device that individualize the performer, but this will allow time to identify extremists, pedophiles and other intruders who distribute illegal information via the Internet ^{[29, pp. 575-576]}. In addition, it is necessary to take into account that such volumes of information will obviously not be processed by a person, since his resources are not enough for this ^{[30, p. 5; 31, p. 23]}. All basic operations for collection, accumulation, storage, distribution will be carried out automatically, whereas a person – an authorized representative of the state – will be able to access this information only in a situation of necessity in which processing of personal data of a subject is allowed without his consent (paragraphs 2-11 of Part 1 of Article 6 of Federal Law No. 152-FZ of 27.07.2006 "About personal data").

2. The need to protect information about a person's computer handwriting is associated not only with its attribution to personal data, which should be protected in principle, but also with an increased risk to privacy and secrecy caused by the specifics of the technology for obtaining information about computer handwriting. Special programs, hardware and software devices or embedded modules of the operating system (hereinafter, collectively, systems that capture the indicators of computer handwriting, we will, assuming a certain degree of conditionality, call keyloggers) record and store information about each key pressed with timestamps ^{[32, p. 48]}. Thus, information about computer handwriting turns out to be directly related to the specific text being typed. In addition, individual keyloggers also track visited sites, running programs ^[33]. Constant centralized collection, which will be discussed in more detail later, on the one hand, increases the risk of leakage of this information due to illegal actions of intruders, and on the other hand, makes this information fully accessible to the state. In this regard, some authors propose to encode information about computer handwriting so that the system loses contact with the typed text and, through artificial intellectual processing, offers a person only an impersonal output with information about the identity of the person who typed the compared texts, without demonstrating the introductory ones on the basis of which the decision was made ^{[34, p. 55]}. However, it seems that the use of such technological solutions is acceptable only for the "home" use of computer handwriting when implemented in access control systems. That is, with such depersonalization, it is impossible to access data on computer handwriting to solve, for example, the tasks of solving and investigating crimes, where it is necessary to identify the person who printed this or that text. Therefore, in our opinion, it will be promising to solve the problem by using legal rather than technological mechanisms. However, this does not exclude the need to comply with all security rules required to protect the critical information infrastructure of the Russian Federation ^{[35, p. 16]}.

3. One of the legal mechanisms that we indicated in the previous paragraph may be the detailed regulation of the issues of fixing and using information about computer handwriting. To begin with, you can add a mention of it in Article 3 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data", revealing along with the rest of the basic concepts. Expanding the scope of its application may require making appropriate additions to other regulatory legal acts, the existing indication of the existence of computer handwriting exclusively in GOST standards will soon be insufficient ^{[36, p. 123]}. At the same time, we consider it appropriate in some matters to refer to the experience of other states, where, in particular, there is a separate regulation of relations related to the turnover of biometric personal data, as well as at the legislative level, this status is assigned to computer handwriting (see, for example, individual US states, in particular California, China, the European Union, etc.) ^{[32; 19, pp. 97-116]}.

In addition, it is possible at the legislative level to establish an obligation for all software developers to implement keyloggers into their computer devices and provide information about the computer handwriting of users at the request of state representatives. However, a scenario in which there will be an obligation for everyone to install a licensed state keylogger configured to transmit information in real time to the state database seems to be a higher priority. The latter can be either a fully autonomous system or a dedicated unit in a Single biometric System. We believe that this would make it easier to solve the tasks of identifying the executor of the printed text in the framework of activities for the disclosure and investigation of crimes. At the same time, increased requirements for the security of state databases are more likely to guarantee the safety of information about the computer handwriting of individuals in a centralized federal system.

Let's make a reservation that we do not consider it right to consider in the context of legal regulation the issues of using computer handwriting in order to ensure personal information security – the most developed sphere of its use, as evidenced by scientific research and practical developments ^{[37, p. 191]}, since, in our opinion, the absolute legitimization of public relations can lead to stagnation of development, and it is not required in those areas that normally function without a legal framework. However, this does not mean that those aspects of the use of computer handwriting that are of the greatest interest to specialists in the field of computer technology cannot be borrowed by the legal sphere. For example, detailing the general issues of using computer handwriting to ensure information security allows us to talk about the adaptability of the described models of access control to certain systems, individual information in various special fields of activity. For example, there is an urgent need to develop new access control systems for automated systems of the internal affairs bodies of the Russian Federation, mainly in order to ensure the security of the critical information infrastructure of the state ^{[38, p. 22]}, which, however, should be considered within the framework of information law.

4. As for commercial persons, at the present stage, no prohibitive measures should be introduced, however, an obligation should be provided for companies that select information about computer handwriting, an obligation to warn users about it and obtain their consent, for example, according to the model introduced for Cookies ^[39]. It even seems, on the contrary, very useful that commercial companies today record information about computer handwriting, since before the launch of the state system it is the only source of obtaining free samples of computer handwriting, without which it is difficult to conduct identification expert studies. In addition, such activity of companies, similar to the personal use of keyloggers, contributes to progress in this area, allows us to talk about the relevance, relevance and development of technology.

Thus, we have presented possible answers to the stated problematic questions in the field of using information about the computer handwriting of users. However, they cannot be considered exhaustive and the urgent need for further study of this topic by various research teams should be recognized.

In the legal environment, computer handwriting is a fairly young phenomenon, which, in this regard, requires a comprehensive study. We believe that information about him in the conditions of accelerating digitalization can become indispensable for the detection and investigation of crimes, taking the place of information about the traditional handwritten handwriting of a person whose expert research has historically been very widespread ^{[40, p. 197; 41, p. 4]}. However, in order for such use to become possible, it is necessary to create a centralized state system (or allocate a block in the existing one) for the widespread collection of information about computer handwriting.

Since a person will be able to access data on printing speed, input dynamics, pressing force, time interval between keystrokes, etc., only by being an authorized person and in situations where this information is necessary to solve state tasks, and increased security requirements are imposed on state databases, we can talk about that the most important rights of citizens to the inviolability of their private life and the preservation of personal secrets will be respected. We fully share the position of I. Y. Ostapovich and A.V. Nechkin, who believe that "new problems caused by the peculiarities of the implementation of these values on the Internet require the development of the most effective mechanisms for their protection in the new conditions of implementation, and not a complete rejection of them under the pretext of their protection" ^{[29, p. 566]}.

We believe that when implementing the model described by us for the widespread collection of computer handwriting indicators, it will be quite possible to maintain this balance between freedom and security, but this requires a deep and detailed study of all the possibilities and potential risks.

The research was carried out at the expense of the grant of the Russian Science Foundation No. 23-78-10011, https://rscf.ru/project/23-78-10011 /