Biometric CURP in Veracruz Sparks Debate Over Privacy, Security

The biometric Unique Population Registry Code (CURP) has generated considerable debate in Mexico. This new document, which integrates biometric data, such as photographs and fingerprints, has already begun its implementation in the state of Veracruz and is expected to be mandatory for all citizens of the state starting in 2025, raising multiple cybersecurity concerns.

This initiative, initially proposed by MORENA in 2021, was launched with the intention of addressing certification issues and protecting citizens from identity fraud, especially in a context where Artificial Intelligence (AI) presents new challenges.

In 2023, Senators Olga Sánchez Cordero and Mónica Fernández Balboa revisited the initiative with the goal of repealing the General Population Law of 1974, proposing new legislation that would include data such as fingerprints and photographs in the document. Although this proposal advanced in Senate committees in September 2023, discussion was suspended and has not resumed as of October 2024.

Despite not actively discussing the initiative for months, its implementation has already begun in Veracruz. "This mechanism was established in the conurbation to prevent identity theft and protect citizens against Artificial Intelligence (AI)," Guillermo Maldonado, Chief Officer, Civil Registry, explained to El Cronista, adding that starting in January 2025, the new document will be mandatory for official transactions.

Implications of the Biometric CURP

Veracruz citizens will need to obtain their biometric CURP not only for identification purposes but also to access scholarships and pension programs. "We are assisting many elderly people who are being asked for this measure for their pensions and insurance," added Maldonado.

The focus on protection against identity theft is relevant in an environment where the use of advanced technologies presents significant risks. Isabel Manjarrez, Security Researcher, Kaspersky, told Expansión that "75% of users in Latin America believe biometric tools are secure, reflecting high acceptance of this technology." However, the proposal has also raised concerns about security, particularly focused on scams and breaches of sensitive biometric data. According to Manjarrez, this becomes more relevant when considering the centralization of biometric information, which creates a single point of attack susceptible to cyberattacks.

"Unlike a password, once exposed, biometric data cannot be modified. This represents a significant risk, as the consequences of a cyberattack could be devastating," Manjarrez stated.

In addition to security risks, the biometric CURP could lead to the exclusion of citizens from social programs. According to the Network in Defense of Digital Rights (R3D), there is ambiguity in data collection, which puts the most vulnerable individuals at risk and can create an exclusion gap for those who do not wish to use this resource.

Moreover, mandatory registration could lead to data being shared without proper consent, which would particularly affect the most vulnerable sectors of the population. The centralization of data also increases state surveillance capabilities, potentially allowing for monitoring of personal activities and restrictions on fundamental freedoms, says Expansión.

According to multiple media outlets, with the advancement of the biometric CURP in Veracruz, pressure for its adoption in other states and at the national level could increase.

"In a context of risk of abuse by state and criminal actors, it is considered that the project should be reevaluated to protect the security and human rights of the Mexican population," Manjarrez noted.