{
 "slug": "keystroke-dynamics-behavioral-biometrics-fail-against-remote",
 "topic_id": "TOPIC-084",
 "cluster": "Remote Workforce & Insider Threat",
 "tier": "Tier B",
 "title": "Behavioural biometrics cannot tell tired from impostor",
 "summary": "Typing rhythm and mouse movement vary with fatigue, injury, hardware and mood. A model trained to spot deviation flags all of those, and misses a patient operative who has learned the baseline.",
 "lede": "The premise is appealing: everyone types differently, so typing patterns identify people. The premise is true and the operational consequences are worse than the premise suggests.",
 "date": "2024-11-20",
 "category": "Future of Work",
 "author_id": "desmond-okafor-hale",
 "tags": [
  "behavioural biometrics",
  "keystroke dynamics",
  "insider threat",
  "false positives",
  "monitoring",
  "continuous authentication"
 ],
 "image_title": "Behavioural Biometrics Tired Or Impostor",
 "schema": "Article",
 "key_takeaways": [
  "Legitimate within-person variation is large, which forces a threshold choice between false positives and missed detections.",
  "The base rate of impostors is very low, so even a good classifier produces mostly false alarms.",
  "A deterministic challenge gives a binary answer on the actions that matter, without monitoring anyone continuously."
 ],
 "body": [
  {
   "type": "h2",
   "text": "Why the variation is the problem"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "Everything arrives as the same signal",
   "caption": "The model sees deviation. It cannot see the cause, and the cause is what matters.",
   "nodes": [
    {
     "label": "Tired, injured, new hardware",
     "note": "flagged",
     "bad": true
    },
    {
     "label": "Genuinely different person",
     "note": "flagged",
     "good": true
    },
    {
     "label": "Patient operative matching baseline",
     "note": "not flagged",
     "bad": true
    },
    {
     "label": "One threshold for all three",
     "note": "no setting works",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "A person's typing pattern is not stable. It changes with circumstances that have nothing to do with identity."
  },
  {
   "type": "ul",
   "items": [
    "Fatigue, illness, caffeine, stress",
    "A different keyboard, a laptop versus a desk setup, an external mouse",
    "Injury — a sprained wrist changes everything for weeks",
    "Task type — writing prose differs from writing code differs from filling a form",
    "Environment — working on a train, on a sofa, at a standing desk"
   ]
  },
  {
   "type": "p",
   "html": "A model sensitive enough to detect a different person is sensitive enough to detect a person with a cold. The deviation looks identical because it is the same kind of signal."
  },
  {
   "type": "h2",
   "text": "The base rate problem"
  },
  {
   "type": "p",
   "html": "This is the arithmetic that determines whether the system is usable, and it is usually omitted from vendor material."
  },
  {
   "type": "code",
   "text": "Workforce:                        10,000 employees\nActual impostors:                      2   (0.02%)\n\nClassifier: 95% true positive, 2% false positive\n\n  Impostors detected:               1.9   ≈ 2\n  False alarms:      9,998 × 0.02 = 200\n\n  Alerts generated:                 202\n  Proportion that are real:         ~1%\n\n# 200 employees investigated for being impostors\n# because they typed differently than usual."
  },
  {
   "type": "p",
   "html": "Two hundred investigations to find two cases, and the two may be among the ones dismissed as noise. Operationally this means the alerts get ignored, which is the standard fate of a low-precision signal."
  },
  {
   "type": "h2",
   "text": "The human cost"
  },
  {
   "type": "p",
   "html": "Worth stating explicitly, because it is usually treated as a footnote."
  },
  {
   "type": "p",
   "html": "Being investigated as a suspected impostor is a serious event for an employee. Doing that to two hundred people, most of whom were tired or using a different keyboard, damages trust in a way that is hard to recover from and is not offset by the two genuine detections."
  },
  {
   "type": "p",
   "html": "There are also jurisdictions where continuous behavioural monitoring of employees raises legal questions independent of its accuracy."
  },
  {
   "type": "h2",
   "text": "Why a patient operative is not caught"
  },
  {
   "type": "p",
   "html": "The detection assumes the impostor behaves differently. Someone operating a long-term placement has time and incentive to avoid that."
  },
  {
   "type": "table",
   "head": [
    "Assumption",
    "Reality for a patient operative"
   ],
   "rows": [
    [
     "The impostor's baseline differs",
     "They establish their own baseline from day one"
    ],
    [
     "A handover creates a discontinuity",
     "The handover happens before enrolment, or gradually"
    ],
    [
     "Typing patterns are hard to influence",
     "Typing speed and rhythm can be deliberately moderated"
    ],
    [
     "The model detects the change",
     "There is no change to detect — the baseline is theirs"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The second row is the practical defeat. If the substitution happens at or before the point where the baseline is established, there is no anomaly at any point afterwards."
  },
  {
   "type": "h2",
   "text": "The deterministic alternative"
  },
  {
   "type": "code",
   "text": "# Probabilistic\n  observe continuously → compute deviation → threshold → alert\n  output: a score, requiring human triage\n  cost:   continuous monitoring, 200 false alarms\n\n# Deterministic\n  on sensitive action or on schedule:\n    challenge → signature from enrolled credential\n  output: valid or not\n  cost:   a gesture, taking seconds\n  monitoring: none"
  },
  {
   "type": "p",
   "html": "The second collects nothing and produces no score to triage. Either the credential produced a valid signature with user verification, or it did not."
  },
  {
   "type": "h2",
   "text": "Where behavioural signals still have a place"
  },
  {
   "type": "p",
   "html": "Not as an identity control. As a risk signal feeding into decisions where a probabilistic input is appropriate."
  },
  {
   "type": "ul",
   "items": [
    "Raising the assurance required for a particular session, rather than accusing anyone",
    "Prioritising which sessions get a step-up challenge",
    "Detecting automated interaction, where the deviation is large and unambiguous"
   ]
  },
  {
   "type": "p",
   "html": "In each of those the output is an adjustment rather than an allegation, which is the right use of a signal with this precision. The failure is deploying it as a detector of impostors, where the base rate makes precision impossible."
  },
  {
   "type": "h2",
   "text": "A worked example: the base rate"
  },
  {
   "type": "p",
   "html": "Take 2,000 employees, a model at 95% true-positive rate and 2% false-positive rate, and one genuine impostor in the population over a year."
  },
  {
   "type": "table",
   "caption": "What the analyst sees",
   "head": [
    "Quantity",
    "Value"
   ],
   "rows": [
    [
     "Genuine impostors",
     "1"
    ],
    [
     "Correctly flagged",
     "About 1"
    ],
    [
     "Legitimate users flagged",
     "About 40 per evaluation cycle"
    ],
    [
     "<strong style=\"font-weight:600\">Chance a flag is real</strong>",
     "<strong style=\"font-weight:600\">Roughly 2%</strong>"
    ],
    [
     "Analyst response after a month",
     "Dismiss by default"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Tightening the threshold to cut the 40 also cuts the 1, because a patient operative sits closest to baseline of anyone in the population. The arithmetic does not have a favourable setting."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Our false-positive rate is much lower than 2%.”</strong> Then it was measured on a population that was not injured, tired or changing hardware. Those conditions are the normal state of a workforce over a year."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“It is one signal among many.”</strong> As routing input, fine. The problem is when it gates access, because then a repetitive strain injury becomes a lockout and the employee has no way to argue with a score."
  }
 ],
 "faq": [
  {
   "q": "Why do behavioural biometrics produce so many false alarms?",
   "a": "The base rate of impostors is tiny. Even a good classifier applied to ten thousand employees generates hundreds of false positives for a handful of real cases."
  },
  {
   "q": "Why doesn't it catch a patient operative?",
   "a": "If the substitution happens at or before baseline establishment, the baseline is theirs and there is no anomaly to detect at any later point."
  },
  {
   "q": "Is there any good use for these signals?",
   "a": "Yes — as a risk input that raises the assurance required for a session, or prioritises step-up challenges. Not as a detector of impostors."
  },
  {
   "q": "What does a deterministic challenge cost?",
   "a": "A gesture taking seconds, on sensitive actions or a schedule. It collects nothing continuously and produces a binary result rather than a score to triage."
  },
  {
   "q": "Can the model be tuned to fix this?",
   "a": "No setting works. Tightening cuts the false positives and the true positive together, because the patient operative sits closest to baseline."
  },
  {
   "q": "What is the human cost?",
   "a": "A wrist injury or a new keyboard produces weeks of flags, and the employee cannot argue with a score they cannot see."
  },
  {
   "q": "Where do behavioural signals belong?",
   "a": "In investigation and routing, read by a human in context — not gating access."
  }
 ],
 "sources": [
  {
   "t": "NIST SP 800-63B — reauthentication and session management",
   "u": "https://pages.nist.gov/800-63-4/sp800-63b.html"
  },
  {
   "t": "Literature on base rate effects in rare-event detection."
  },
  {
   "t": "EDPB guidelines and opinions on data protection at work",
   "u": "https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en"
  },
  {
   "t": "NIST SP 800-63B — Authentication and Lifecycle Management",
   "u": "https://pages.nist.gov/800-63-3/sp800-63b.html"
  }
 ],
 "related": [
  {
   "slug": "dprk-it-worker-laptop-farm-prevention-guide",
   "title": "Hiring one person and employing another",
   "category": "Future of Work"
  },
  {
   "slug": "zero-biometric-workforce-assurance-model-verifying-identity",
   "title": "Workforce assurance without biometric collection",
   "category": "Future of Work"
  },
  {
   "slug": "client-side-face-liveness-fails-fatal-flaws",
   "title": "Why browser-based face liveness cannot be trusted",
   "category": "Developer"
  },
  {
   "slug": "remote-desktop-protocol-rdp-anydesk-forwarding-hardware-keys",
   "title": "Why a hardware key will not work down a remote desktop tunnel",
   "category": "Future of Work"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Behavioural%20Biometrics%20Tired%20Or%20Impostor/1500_900/blog.jpg",
 "wordcount": 960,
 "url": "/blog/keystroke-dynamics-behavioral-biometrics-fail-against-remote.html",
 "reading_time": "4 min read",
 "meta_description": "Typing rhythm varies with fatigue, injury, hardware and mood. A model that flags deviation flags all of those and misses a patient operative.",
 "hub": {
  "slug": "topics/remote-workforce-identity",
  "title": "Remote workforce identity"
 },
 "answer": "Because both look the same to the model: a deviation from baseline. Fatigue, a wrist injury, a new keyboard, caffeine and a different chair all move typing rhythm, and a patient operative deliberately does not. The signal the system is built on is dominated by noise it cannot label.",
 "answer_q": "Why can behavioural biometrics not separate tired from impostor?",
 "glossary": [
  {
   "term": "Base rate",
   "def": "The underlying prevalence of the thing being detected, which dominates how often an alert is real."
  },
  {
   "term": "Behavioural biometric",
   "def": "A model of typing, mouse or interaction rhythm used as an identity signal."
  },
  {
   "term": "Patient operative",
   "def": "An attacker who deliberately conforms to the baseline, which is exactly what the model rewards."
  }
 ],
 "checklist": {
  "title": "Using behavioural signals responsibly",
  "id": "behavioural",
  "desc": "Five steps.",
  "steps": [
   {
    "name": "Never let a score block access on its own.",
    "text": "It cannot distinguish tired from impostor."
   },
   {
    "name": "Compute your own base rate before buying.",
    "text": "With a realistic impostor prevalence."
   },
   {
    "name": "Ask the vendor about injury and hardware change.",
    "text": "The answer is usually silence."
   },
   {
    "name": "Gate the consequential actions deterministically.",
    "text": "A signature, not a probability."
   },
   {
    "name": "Keep behavioural output for investigation.",
    "text": "Where a human reads it in context."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav replaces the probability with an artefact: a hardware signature over the rendered effect. It does not care how tired you are.",
  "href": "../docs.html",
  "label": "See deterministic gating"
 }
}