In biometric identification, a fingerprint is typically represented as a set of minutiae which are 2D points. A method [4] to protect the fingerprint template hides the minutiae by adding random points (known as chaff ) into the original point set. The chaff points are added one-by-one, constrained by the requirement that no two points are close to each other, until it is impossible to add more points or sufficient number of points have been added. Therefore, if the original template consists of s points, and the total number of chaff points and the original points is m, then a bruteforce attacker is expected to examine half of m chooses s possibilities to find the original. The chaff generated seem to be "random", especially if the minutiae are also randomly generated in the same manner. Indeed, the number of searches required by the brute-force attacker has been used to measure the security of the method. In this paper, we give an observation which leads to a way to distin...