Friday, October 29, 2010

Finger-ID technology comes to Erie High

Finger-ID technology comes to Erie High; critics worry about data security (Daily Camera [Colorado])

Fingerprint biometrics streamline the school lunch process and the kids love it.

The quote from the ACLU spokesman really got my attention.
Judd Golden, chairman of the Boulder County chapter of the American Civil Liberties Union, said the whole question of safeguards in the technology is critical.

"Parents ask, 'Who's got my child's data?'" he said. "Do they have safeguards against possible misuse of that data? It's collecting discreet, personal identifying information, and that data is not necessarily under the control of the district but a third-party vendor."
Rather than knee-jerk reactions, these are exactly the kinds of questions concerned citizens should be asking. Kudos to Mr. Golden.

One more observation:
Despite the obligatory addition of "critics worry about data security" to the headline, no critics are actually quoted in the article. Perhaps the author was referring to the several parents who were upset that the school acted without a proper give-and-take with the public. If that's the kind of critics that adopters of biometric identity management techniques are up against, then that's a situation that can be managed around a civil, rational dialogue.

Thursday, October 28, 2010

Sheriff's department to demo new eye scanners

Boone County Sheriff’s Department is showing off the new iris scanners that are available to deputies and the Boone County Jail (

Iris biometrics are being rapidly adopted by jails.

To understand why, it is useful to have a working knowledge of the framework outlined in:

NATIONAL BIOMETRIC TEST CENTER COLLECTED WORKS 1997-2000 (1.8MB PDF), specifically Chapter 1, section II 'Classifying Applications' (page 13 in your PDF reader, page 3 according to the document's internal numbering).

The categories are:
Cooperative v. Non-cooperative
Overt v. Covert
Habituated v. Non-habituated
Attended v. Non-attended
Standard Environment
Public v. Private
Open v. Closed

Some of these distinctions refer to the individual to be identified while some refer to the technology.

Nowhere have I found a more understandable and concise elucidation of how to understand biometrics in particular and security in general.

Nigerian Ghost Busters

Who you gonna call? Biometrics! (
Lagos — Imo State government has uncovered 184 ghost primary school teachers in the state following a recent biometric staff audit.

This was disclosed to the Governor Ikedi Ohakim by Mr. Dan Okehi of Brickred Consult, at the Executive Council Chambers, Government House, Owerri where he submitted the audit report

Mr. Okehi said that out of the 15,860 teachers that filled the biometric form, only 14,363 were found to be authentic staff of the state Universal Basic Education Board, while 194 were non existence, yet taking salaries.

A ghost worker is a worker that collects a salary and/or benefits, usually from a government entity, while doing no actual work. A ghost worker may or may not be a real person, but the money they make is real and it accrues to a corrupt official.

The old Gummi Bear trick

Sweet bypass for student finger scanner (
But a litany of fingerprint scanners have fallen victim to bypass methods, many of which are explained publicly in detail on the internet. The hacks could potentially be used by students to make replicas of their own fingerprints, or lift those of others from imprints left on the reader.
Imperfect is not the same thing as impractical.

Schools spend a lot of resources in their Identity Management function: calling roll, assigning grades, managing a medical services office (school nurse), collecting health information on student athletes (physical exams), etc. Moreover, in the United States, this challenge occurs in a very strict legal environment (see FERPA).

We all have an interest in how efficiently an industry that is overwhelmingly funded by tax revenues manages its resources. Schools should therefore be encouraged to adopt more effective means to accomplish the demands society places upon them and they should be commended for innovation within their industry.

This article is about using fingerprint readers to measure time-and-attendance in schools. This function is usually carried out by human teachers, reading names from a piece of paper and making notes on a piece of paper. Because human beings are simply the best things in the world at identity management among people they know, this system works really well. But at what cost?

Is reading the names of people from a list really the best use of a highly trained, educated, and professional human resource? Are the constraints this system places upon class size worth it? What metrics would a rival system need to show in order to make switching systems worth the effort and cost? Sadly, questions like these are rarely, if ever, asked in articles like these.

There's also a social angle to this issue. The educational system is wonderful and necessary, not just for filling young minds with humanity's accumulated knowledge, but also for providing a social environment larger and more complex than the nuclear family but far more protected than the larger world. Much of the usefulness of this social environment lies in its ability to communicate to students the boundaries of acceptable behavior in preparation for their full participation in society as adults.

Of course, during this social education, society's rules are sometimes more honor'd in the breach than the observance (see "Ferris Bueller's Day Off", "Animal House", etc.) and that's fine, too, but it's also why this part of the educational process is so important. "Senior Skip Day" or senior class practical jokes are OK. Cheating on exams, not so much.

Which brings us back to the linked article with the sub-headline:
A NSW high school has installed "secure" fingerprint scanners for roll call, which savvy kids may be able to circumvent with sweets from their lunch box.

The scare quotes around "secure" invite the familiar (around here) refrain: "Compared to what?" Deeming young identity thieves "savvy kids" implies that the author believes that a technology's inability to overcome failures of educational will is a technological, rather than an organizational shortcoming. In the real world, identity theft and fraud can get you thrown in jail. Educators don't call those who cheat on exams, skip school and forge notes from parents "savvy kids". Why would they do so when the issue is identity theft? They wouldn't.

In answer to the "Compared to what?" question, I'd place fingerprint biometrics between full-time teachers and substitute teachers in terms of identity management effectiveness at a fraction of the cost.

Adopting technology to alleviate a bureaucratic problem often makes sense, but this issue is totally separate from a student's social education. If educators are unwilling to monitor for- and punish the hacking of time-and-attendance systems through identity theft among their students, the "technology" won't work. If they treat use of the system in the same way they treat other student responsibilities, it will.

Thankfully, educators have a very different sense of their responsibilities than does this article's author.

Monday, October 25, 2010

3M Extends Subsequent Offering Period for Shares of Cogent, Inc.

The expiration date of the subsequent offering period has been extended to 5:00 PM, October 26, 2010 (
If, following expiration of the subsequent offering period, Ventura Acquisition Corporation owns more than approximately 66.5 million Cogent shares, 3M intends to exercise the option, under the terms of the previously announced merger agreement, to purchase directly from Cogent a number of additional shares sufficient to give Ventura Acquisition Corporation ownership of one share more than 90% of Cogent’s outstanding common stock. This would permit Ventura Acquisition Corporation to complete a short-form merger with Cogent under Delaware law without the need for a meeting of Cogent’s shareholders.
Ventura Acquisition Corporation is wholly owned by 3M.

Queensland, Australia to adopt biometric driver's license

QLD biometric licenses to go ahead (
The new licence features an embedded chip with personal information, security PIN and shared secrets, and also utilises 16 point facial recognition technology. When drivers renew or apply for the new licence, a digital photograph will be taken and centrally stored. Each subsequent renewal of the licence will reference the image and using the facial recognition technology to ensure the driver is who they claim to be.
For information on what was driving the changes see this article from the same source.

Friday, October 22, 2010

Biometrics to be required of certain UK visa renewal applicants?

Biometric permits on the cards for Tier 1 and Tier 5 UK Visa applicants (

If Parliament adopts the proposed new rules...
If you make your application to extend your stay in the UK by post, the Border Agency will send you a letter after receiving your application. The letter will tell you how to book an appointment to enrol your biometric information at one of the biometric enrolment centres.

Thursday, October 21, 2010

UPDATE: Pilot's Licenses don't have photos?

UPDATE: TSA, Pilots Weigh Biometric System for Airport Screening (
Pilots who fly passenger and cargo planes want the U.S. government to implement a program under which their identities will be confirmed using biometrics so they can pass quickly through airport security checkpoints and avoid -- for the most part -- controversial screening procedures involving body scanners or pat-downs.
The recent controversy over airport screenings has had at least one positive effect. All of a sudden, pilots are embracing biometrics as an identity management technique that is far less intrusive into privacy and conducive to security than many alternatives.

--Original post follows--
Today, the only pilots pictured on FAA licenses are flight pioneers Wilbur and Orville Wright (
In an attempt to improve security, Congress told the Federal Aviation Administration in 2004 to come up with a pilot's license that included the pilot's photo and could contain biometric information like fingerprints or iris scans. Today, the only pilots pictured on FAA licenses are flight pioneers Wilbur and Orville Wright, and the licenses lack biometric data.

This is astounding, especially when read together with this, via Drudge: Pilot Refuses Full-Body Scan, Says TSA Doesn’t Make Travel Safer (

Then there's this from two days after 9/11: Police investigating theft of American Airlines uniforms, key card (

There's always a risk that changes in security measures will be resisted or skirted by those falling under the new rules. That's why it's always a good idea to consult with the people the new measures will affect when implementing or changing a security plan. These are the people that can make or break your efforts to achieve your security goals.

A common refrain around here is that security, biometrics and ID management are all about people.

The civilian air travel bureaucracy really has people problems everywhere they turn. Their customers/stakeholders don't like them and their employees don't like them, either. Skipping obvious, low tech solutions like photo ID's for pilots while instituting intrusive, annoying, expensive and time consuming solutions falling on everyone seems calculated to communicate the appearance of security over substantially increasing the safety and, hence, value proposition that government agencies offer their stakeholders and airlines offer their customers.

US Gov, Northrop Grumman test emergency ID interoperability system

The demonstration, dubbed "Autumn Blend," showed the use of standardized personal identity credentials operating across multiple domains (, giant font alert)
One of the scenarios of the Autumn Blend demonstration simulated a collaborative incident at Northrop Grumman's Shipbuilding facility in Newport News, Va. As first responders from the city, Commonwealth and federal government convened on the site, their individual personal identity credentials were presented and read electronically at various authentication points for physical and logical access to the demonstration. These credentials included the U.S. Department of Defense Common Access Card, First Responder Authentication Credential, Personal Identity Verification and Personal Identity Verification-Interoperable credentials.

This is really cool. There are hundreds of forms of ID out there. Take one rush hour ride on the DC Metro and you'd be amazed at how many different ID's you'll see dangling from the riders' clothes and accessories.

Developing a system that can translate among various forms of ID in an emergency has obvious benefits.

Wednesday, October 20, 2010

Fingerprint biometrics among safest identity protection tools

How do you protect your identity? It takes more than just passwords (
Streaming Audio & MP3 download at the link

Following on the Unisys survey we mentioned here comes this:
Bryan Ichikawa, vice president of identity solutions at Unisys, joined the DorobekINSIDER to discuss the most secure way to protect your identity.

Tuesday, October 19, 2010

Desert Sands, CA may test biometric school bus rider tracking

Students participating in the test would swipe a finger across a scanner on the bus every time they board and exit.

An alarm would trigger if a student tried to get on or off at the wrong stop.

“It's definitely a wonderful safety component,” Superintendent Sharon McGehee said.

In 2007, three first-graders from Desert Sands were mistakenly dropped off at the wrong location early in the school year and rescued by neighbors.
I think a lot of people would be surprised to learn just how challenging a school's identity management environment really is.

First, school is compulsory; most parents really don't have much of a choice about whether or not to send their child to school. The compulsory nature of school attendance places an extraordinary burden on schools to ensure student safety. The added fact that children are legally recognized to be unable to take responsibility for themselves necessarily increases the responsibility schools have regarding child safety.

Given these responsibilities, can anyone be surprised that schools are among the vanguard of biometric solution adoption? It would be strange if they weren't.

Monday, October 18, 2010

Citibank to roll out voice biometrics

Funny CEO image of the day...
"I personally registered and then tried to beat it. I spoke in a girl's voice. I muffled my voice ... I pretended I had a cold. It got it right," he said.

Friday, October 15, 2010

Army Takes Hands-On Approach to Biometrics Sharing

Formerly known as the Biometrics Task Force, the Biometrics Identity Management Agency in March became a full-fledged U.S. Army agency with a departmentwide mission. Swan foresees a time when biometrics data will be used to identify friendly or enemy troops wounded on the battlefield, to ensure soldiers and their families receive authorized health care, and to identify displaced persons or track those who have received emergency rations following natural disasters:

Thursday, October 14, 2010

Unisys Poll: 63% of credit card users would prefer fingerprint

[Almost] Two-Thirds of Consumers Prefer Credit Card Verification by Fingerprint (; UPDATE: broken link removed)
Responding to the question, "Which do you believe is the safest method to prove your credit card is being used by you?" the online poll found that 63 percent of more than 300 respondents preferred fingerprints as the best method for identity verification and authentication as compared to photo identification (20 percent), PIN numbers (13 percent) and handwritten signatures (six percent).

This poll gets at the "compared to what?" question we frequently ask here. It explicitly asks respondents to compare a biometric modality to what techniques/technologies are currently in use and, unsurprisingly, consumers find the status quo wanting.

I also think it's worth noting that the second-preferred choice, Photo ID (20%), is also a biometric. The photo on the ID is the database image and the customer's face is the probe image. The biometric matching algorithm is within the brain of the person making the comparison.

So, 83% of those surveyed believe biometrics serve their information security better than PIN's and signatures.

Wednesday, October 13, 2010

Biometrics: Humans as Keys

The Future of Biometrics by research consultancy Acuity Market Intelligence (

Here's a good summary of a recent industry report on some challenges and opportunities in the ID management sphere.
Any remaining problems with biometrics will no doubt be ironed out with time, as new technological developments emerge, and standards are developed for the technology However, the industry is more interested in the bigger picture, integrating biometrics into existing and new applications, not so much as a standalone one-size-fits-all security technology, but as enhanced solutions to existing and new challenges.

Tuesday, October 12, 2010

Ears provide new way of identifying people

"With biometrics, a lot of the problems is what happens when people get old. With facial recognition, the systems are often confused by crows feet and other signs of ageing. Your ears, however, age very gracefully. They grow proportionally larger and your lobe gets a bit more elongated, but otherwise your ears are fully formed from birth."

Ears have been in the biometrics news a lot the last few days.

-Facial recognition accuracy is degraded as the pose angle diverges from a full frontal view. As pose angles get bigger, an ear will come into view. Tying an ear-recognition system to a face recognition system could make more identifications possible, especially with a non-participating subject.

-Ears aren't really that stable. They grow throughout life, as the quote above addresses.
-As high school wrestlers can attest, ears are easily deformed by trauma.
-Hair obscures significant portions of the ear in a significant percentage of the population.

That's not to say that they aren't or won't be useful.

As a wise man once said: "Biometric X is a great biometric, if it's the only one you have."

There are bound to be applications where the ear is the only anatomical identifier at hand and for those applications ear-recognition algorithms will be useful.

Friday, October 8, 2010

Thursday, October 7, 2010

Giving identity to Delhi’s homeless
For Abida Begum (20), a homeless woman who makes Rs 100 a day washing clothes in the untidy sprawl of Delhi's Nizamuddin Basti, India's Unique Identity (UID) project will, hopefully, stop constant police probing and harassment.
“I am told that I can open a bank account with the card (number) given. We were unable to open one, all this time, because I could not give proof of address or who I am,” said Ibrahim, who's been living in the Capital for more than 10 years.
Can you imagine an existence where you couldn't identify yourself to anyone who didn't know you already?

This post mirrors these two dealing with Afghanistan.
Biometrics: Giving Afghans an identity
Biometrics: Giving Afghans an identity UPDATE

Wednesday, October 6, 2010

Busted: Woman, 81, jailed in vote-fraud case

Woman, 81, jailed in vote-fraud case (, via Drudge)
Bexar County deputies Monday night arrested a woman accused of using her long-dead sister's identity to vote twice in the 2008 general election.
The Texas Department of Public Safety's image verification system matched the photo on Comparin's driver license to the one on the “Collins” license, according to the affidavit.

Brazilian election biometrics have 93.5% success rate

The website of the Diario Catarinense, from Port Alegre, the state capital of Rio Grande Do Sul, said that 742 biometric machines had been installed in the city, and only three removed from service due to problems, or around 0.4 percent. An official at the TSE said the machines should be rolled out to the whole nation in 2014.

Among English language media outlets, this topic seems to have generated interest in the Chinese press and not elsewhere.

I tried without success to chase down the Porto Alegre article for any Portuguese speakers out there. If any readers happen across it, I'll certainly post a link.

This may be the article referenced by Xinhua:
Eleitores do município de Canoas (RS) aprovam urna biométrica

Nely Menetrier, 84 anos, também se mostrou satisfeita com a urna biométrica.

– Gostei da nova urna, foi fácil e rápido.
84 year-old Nely Menetrier also expressed satisfaction with the biometric ballot box. "I liked the new ballot box; it was easy and fast."

Voting is compulsory in Brazil so technologies that make the process more manageable will have a large impact. It wouldn't shock me if more votes are cast in Brazil than any other country.

Did their voices betray them?

Did their voices betray them? The discovery of an alleged terror plot against Europe owes at least some of its success to "voiceprint" technology that allows law enforcement to electronically match a voice to its owner.

The technique – which some compare to fingerprinting – can be a powerful anti-terror tool, officials increasingly believe. Law enforcement agencies are already considering how a voice database could help thwart future plots.

Cogent-3M merger overcomes shareholder action

Pasadena-based Cogent, the developer of fingerprint and other biometrics devices, reported this morning that a Delaware court has denied a shareholder motion to block the acquisition of the firm by 3M.

Friday, October 1, 2010

Contract awarded for $142M FBI project

Once completed, the new facility will allow the FBI CJIS Division, which already has the largest centralized collection of biometric information in the world, and the Department of the Army, which has also developed military biometrics database systems in coordination with the FBI, to make advances into other identification technologies, such as DNA, iris, palm prints and facial recognition.