A column about curious stories from the worlds of science, technology, and film. Today — no film: a production story about how human tremor became the key piece of evidence. Three acts: WWII radio operators whose “hand” could be recognized over the air like a fingerprint; a machine that, forty years later, learned to read that hand in the keyboard and mouse; and bots that are now learning to tremble on command — so they won’t be caught out by their perfection.
Every telegraph operator had a “fist” — a handwriting of the hand. Morse code is formally discrete: dot, dash, pause. But a living operator is no metronome. One “presses” dots a little longer than prescribed, another spaces groups out faster than regulations allow, a third makes a signature micro-delay before changing characters. A listening radio operator recognized familiar people “by their hand” as unmistakably as by their voice over the phone.
The military turned this trait into a tool. In the British Commonwealth, the bundle of methods was called “Z intelligence”: TINA (an abbreviation formed from the last four letters of “Serpentina” — the name given to the method of recording live radio traffic onto paper tape for analysis) plus RFP — Radio Finger Printing, the cataloguing of particular transmitters. The logic of TINA is described simply in memoir literature and analyses of Allied signals intelligence: don’t try to crack the cipher; identify the radio operator himself. A radio operator is a living variable: he gets sick, leaves, goes down with his ship. If a particular “hand” surfaces at a new position, the previous one has probably been destroyed or redeployed. Style becomes a map of enemy movements.
The International Spy Museum in Washington holds a curious artifact: the Telegrapher’s Fingerprint Chart — a handbook for analysts in which the handwriting of the airwaves is laid out like fingerprint cards. A metaphor turned into a technology.
The most beautiful thing about this story is that ciphers could not undo it. Enigma changed settings every day, codebooks were revised, but the “fist” had been with the operator since birth: speed, rhythm, characteristic “tails” at transitions. Change the mirror as often as you like — the gait remains. That is why, when call signs changed, handwriting analysis kept working: behavior was the one channel the enemy could not replace at the snap of its fingers.
Let’s jump forty years ahead, from the airwaves to the RAND machine room. In 1980, Leslie Gaines and co-authors published the report “Authentication by Keystroke Timing”: seven professional typists repeatedly typed the same pseudo-logins; researchers measured the intervals between keystrokes and the duration of key presses. The conclusion sounded like science fiction, then became basic literacy: the statistics of key pairs — the same “digraphs” measured in radio operators — can distinguish one person from another. Every typist has her own signature of timings. It is not the keyboard that is unique — it is the rhythm.
Between “can distinguish” and “can be trusted” lies an abyss, and it was honestly quantified only thirty years later. Killourhy and Maxion (CMU, 2009) ran 14 different detectors against the same data — 51 users, 400 password-entry repetitions: the best one (Manhattan with scaling) produced an error rate of 9.6%; the middling ones, 0.10–0.16, meaning every tenth outsider was accepted as one of their own. Consider the scale: this is not biometric passport control. It is a weak, noisy, but free and ever-present signal — one you cannot leave at home, reset, or change at a website’s request.
Then the same trait was found in the mouse. And this is where things get really interesting.
When the cursor sits in a fixed position, a living hand does not. Physiological tremor — a normal, healthy, rhythmic dance of motor units — blurs stillness at frequencies of roughly 8–12 Hz. A mouse polling at hundreds of hertz records that dance. In 2019, a Microsoft Research group turned it into a diagnostic tool in npj Digital Medicine: from 2.7 million Bing users, they extracted tremor from the paths of “stationary” cursors — the median tremor frequency came out at 6 Hz, lower than the textbook 8–12: cursor polling frequency cuts off the upper part of the spectrum — and that, too, had to be taken into account. The analysts built a population-scale picture of how tremor is distributed by age, sex, and reported diagnoses, including its connection to Parkinson’s disease; plus a separate validation study of a thousand remote participants with self-reports. The mouse cursor turned out to be a free, already deployed sensor for neurology.
For antifraud, this meant one thing: “perfect” stillness is an anomaly. A machine pretending to be human cannot merely land on the right pixel. It has to tremble with the right spectrum, with the right occasional “thoughtfulness,” with the human excess of its trajectory — arcs instead of chords, micro-corrections at the target, a slowdown before the click. Perfection became evidence. For the first time in the history of authentication, the key piece of evidence was a defect.
The industry responded predictably — with money. BioCatch, the flagship of behavioral biometrics, passed under Permira’s control in the autumn of 2024 at a valuation of $1.3 billion: more than 200 financial institutions, over 30 of the world’s top 100 banks, 400+ million banking customers under continuous observation, and $4.72 billion in prevented fraud since 2018, according to its own report. In the industry quadrants of 2025, BioCatch, Feedzai, and IBM are named as leaders in behavioral biometrics. This is no longer a “feature”; it is an infrastructure layer: the bank does not ask who you are — it watches how you hold your phone, how fast you scroll, in what order you fill in the fields. The mechanics are simple: a client whose behavior matches their own history notices nothing. Behavior that strays from its own rut triggers a ritual: a step, a question, a call.
The legal framework, meanwhile, is surprisingly slippery. Article 9 of the GDPR prohibits the processing of biometric data “for the purpose of uniquely identifying a natural person” without explicit exceptions — but behavioral profiles are usually framed not as identification, but as “session risk assessment,” which moves them out of the strictest corridor and into the general zone of legitimate interest (fraud prevention). A person with a thousand clean transactions behind them gave no biometric consent — and their cursor wanderings have still been recorded, measured, and compared. Not a “special category,” not a password, not a PIN — simply the way you move has become a document.
The obvious question: if humans are caught by their imperfections, why shouldn’t a machine pretend to be imperfect? The answer is simple: that is exactly what is happening. That is the resolution of the whole arc.
The first generation of bypasses was mechanistic: the ghost-cursor library for Puppeteer draws trajectories with Bézier curves and random deviations — no longer a straight line, but still mathematics. Then neural networks arrived. In October 2024, a group from Sichuan University rolled out DMTG — a trajectory generator based on a diffusion model with entropy-controlled randomness, trained on movement records from 120 living users plus a million trajectory samples. Against supervised detectors, DMTG reduced confidence in bot detection by 4.75–9.73 percentage points; against commercial systems (Akamai, GeeTest), the authors reported an “almost human” pass rate — with the caveat that they could not disclose the details, due to trade secrets. You read it and realize: somewhere, right now, there is a pipeline trembling in place of a machine.
The other side is evolving too, and nowhere is this clearer than in the unit economics of detection. In 2025, Voidware researchers showed that 17 kinematic features (conformity with Fitts’s law, submovement morphology, smoothness, geometry) on the Balabit and BOUN datasets yield an EER no greater than 0.001 — that is, theoretically near-flawless detection of synthetic movements built “by the book.” The industry’s practical answer is micro-scale: compact neural detectors right in the browser. cside’s cursor_v2 model weighs 0.12 MB (10,600 parameters), runs on CPU in 0.74 milliseconds per movement, and, according to its report, catches 86–100% of synthetic trajectories from every generator known to it at ~0% false positives in a control sample of living people; against a generator the model had never seen, its AUC is 0.999 versus 0.920 for the previous generation. The industry’s bet has shifted radically: not to identify a bot by its browser fingerprint, but to identify it by the accent with which it “writes” its movements.
Here, one has to pause over the loop. Every detector publication is a textbook for generators: show WHAT exactly you are extracting (smoothness? speed distribution? spectrum?) — and tomorrow it will be incorporated into models. Every generator publication undermines detectors: DMTG is effectively an open declaration of “here is how to bypass modern senseless checks.” This is an arms race in which the ammunition is scientific papers. And unlike classical biometrics (you cannot melt down a finger), behavioral biometrics are fundamentally vulnerable: anything that can be recorded can be imitated.
Let us return for a second to the radio operators. The TINA system had a property that no one then called privacy: the “fist” worked only in contact with the airwaves. You do not transmit — you do not give yourself away. Behavioral biometrics in the digital age work without a special operation: the very act of using a laptop is already airwaves, already recording, already analysis. Gartner’s “continuous authentication” is TINA working full time: tracking not at the moment of a transaction, but constantly, with every gesture.
And the most piquant thing about this “form of honesty”: a behavioral profile is not “behavioral data” in the commonly understood sense; it is data about the body. Cursor tremor (see Microsoft/Bing) is a candidate for neurological screening. Typing speed is a proxy for age, sobriety, stress, temper. Mouse patterns are a documented candidate for detecting depression and attentiveness. All this without a single fingerprint scanner, without a camera — from the mere fact of “hand on mouse.” We agreed to cookie banners, and got a motor-skills sensor embedded in every interface on the planet.
Three ages of one idea. The thirties–forties: the “fist” as a military spy in the airwaves — identify the radio operator, map his movements. The eighties–our own day: the same mechanics inside every login — RAND’s 7 typists have grown into BioCatch’s 400 million tracked customers. Now: machines are learning to tremble, detectors are learning to spot fake tremors, and the question “is this a human?” is migrating from the realm of passwords into the realm of accent.
The moral of this story is uncomfortable. Perfection gives away the machine — but a person gives themselves away too, just differently: through the unhurried uniqueness of their mistakes. Behavioral biometrics are a bet that defects are inalienable. The entire industry rests on one assertion: “a real human cannot help trembling.” Against it stands another industry with a direct mirror-image thesis: “artificial tremor is indistinguishable from real tremor.” Which of them is right will be decided not in science and not in philosophy, but in conversion rates, in fractions of a percent, between the lines of AUC statistics.
Sources: International Spy Museum — Telegrapher’s Fingerprint Chart; Jerry Proc / Antique Wireless Association Review #36 (2023) — RFP and TINA; ARC Archive — SOE fingerprinting; Gaines, Lisowski, Press, Shapiro — “Authentication by Keystroke Timing” (RAND R-2526, 1980); Killourhy & Maxion — “Comparing Anomaly-Detection Algorithms for Keystroke Dynamics” (DSN 2009); Estrada et al. — “Population-scale hand tremor analysis via anonymized mouse cursor signals” (npj Digital Medicine, 2019); Permira press release 09.09.2024 (BioCatch $1.3B, 400M+ customers, $4.72B in prevented fraud); QKS Group / Biometric Update (Aug. 2025) — Spark Matrix behavioral biometrics; DMTG: Human-Like Mouse Trajectory Generation (arXiv:2410.18233, Sichuan University); Tiwana — “Kinematic Features Are All You Need” (Voidware, 2025); cside.com — cursor_v2 (2026); GDPR Art. 9; Google reCAPTCHA v3 docs; Monrose & Rubin — “Authentication via Keystroke Dynamics” (ACM TISSEC).