Nov 22, 2023

Gilles Sabrié/The New York Times Monitors display a video showing facial recognition software in use at the headquarters of the artificial intelligence company Megvii, in Beijing, May 10, 2018. Facial recognition technology is increasingly being used in sports venues for security purposes. November 22, 2023 at 6:30 a.m. Sports stadiums and concert arenas are pulling out all the stops to take fan engagement to the next level. Large-scale venues are constantly upgrading their technology to offer connections at every turn for everything from processing payments to ticket transactions, mobile ordering, sensory rooms and other digital advancements that supercharge the fan experience. Whether at an NFL game, soccer match, concert or other mega-event that attracts thousands of people to one venue, fans are increasingly connecting through mobile technologies and digital platforms that boost their experience and engagement. While metal detectors and surveillance tools are a common sight outside arenas, it’s not just physical attacks that threaten fan safety. All those apps, QR codes, ticketing services, betting sites and social media feeds can also leave fans vulnerable to hackers who prey at the intersection of digital connectivity and human fallibility. Concertgoers and sports fanatics of all stripes have never been more vulnerable to a variety of digital risks at these hyper-public events. Using tech to address safety threats More than ever, the lines between cyber and physical security are being crossed with risks to fans, teams, staff, onsite vendors and stadium operators alike. Although security measures such as guards and cameras may address traditional physical security concerns, digital technologies are being widely deployed in the effort to reduce risk in the stands. For example, both text messaging and biometrics are being leveraged to support security operations during events. Darren Guccione is CEO of Keeper Security. One egregious case involved a violent riot in March 2022 at Estadio Corregidora stadium in Querétaro City, Mexico, during a soccer match. Querétaro Football Club (F.C.) fans wielded advertisement boards, metal gates and chairs to attack opposing Atlas F.C. supporters, who were badly outnumbered. Hundreds of families ran onto the field to escape the unfolding chaos. The riot shocked the nation as dozens of fans were injured, with social media posts showing videos of the violence and victims of the riot. Those distressing images stained the reputation of Mexico’s professional soccer league, Liga MX, which took aggressive steps to implement technology that would help mitigate the chance and severity of a future attack. The organization installed a biometric facial recognition system called Fan ID, which embeds facial biometrics directly into tickets, while keeping personal information stored on the user’s device. Elsewhere, stadium managers post bulletins on digital scoreboards asking ticket holders to send texts about disturbances or bad behaviors that they spot. The goal is to digitally identify problematic fans before their actions pose a serious threat to other fans, players or the stadium itself. Fans must play digital defense Although the proliferation of digital technologies is being used to both bolster the fan experience and address physical safety concerns, the technologies themselves pose serious cybersecurity risks that cannot be ignored. Cyberattacks can occur anywhere, against anyone, at any time, and in unexpected ways. The large numbers of people in attendance at sporting events creates a wealth of personal data for cybercriminals to target. In 2021, a Minnesota scammer allegedly used stolen consumer login credentials to steal streaming TV services for Major League Baseball games, then resell them illegally on the dark web. In February 2022, the San Francisco 49ers IT network was hobbled by a ransomware extortion attack from the BlackByte ransomware gang. Beyond the exhilaration of fandom lie digital dangers that all fans should recognize and prepare for. Unfortunately, going on defense has now become a necessary part of the game. To guard against being phished, fans should avoid clicking on questionable links found in emails or text messages about their favorite teams or events. Passwords to any streaming, shopping, gambling, fan experience or team website should be at least 16 characters long with a combination of upper and lowercase letters, numbers and special characters. These passwords should be different for every website and stored in a secure password manager — not on a notepad or in the user’s phone. Furthermore, multi-factor authentication should be enabled on every account that makes it available. Cybersecurity is a team effort The obligation to digitally protect fans doesn’t just fall on the fans themselves. When monitoring threats against large events, IT professionals need to consider the security of their third-party vendors, insider threats from employees or contractors, as well as newly introduced technologies that could present points of access that may not have existed the year before. Mobile app developers and marketers are also complicit in this digital ecosystem that profits off the fan experience, particularly when it comes to payments. Venues must ensure they’re using trusted and secure cashless payment methods such as PIN-enabled cards or secure app-based payment methods with biometrics. The cybersecurity teams working with event organizers should have a comprehensive security plan that includes increased network monitoring, training and refreshing employees on both cyber and physical security practices, as well as stress testing for cyber resiliency. Like any security operation, event organizers must remain vigilant to protect against malware, viruses and social engineering attacks. Big games carry big risks, but they can, and must, be mitigated. The time to act is now — before fans find themselves on the losing side of the cybersecurity scoreboard. Darren Guccione is CEO of Keeper Security , a cybersecurity firm.