UK: Immigration politics and biometrics

The United States isn't the only place where immigration politics — and the role of biometrics — are coming to the fore. They're very timely issues in the UK, as well.

WorkPermit.com covers Prime Minister David Cameron's policy prescriptions like the dew covers Dixie, here: Cameron announces tough reforms to UK immigration.

The Guardian provides some analysis here: Immigrants' residents permits: how would they work?

The repeated refusal of GPs, social housing officers and social security staff to act as immigration officers also means that if more robust residence tests are to be introduced for other EU nationals then an easy and authoritative way is needed of checking how long they have been in the country and what their immigration status is.

Ministers have confirmed that they are looking at plans to take fingerprints and other biometric data to be stored on a card with a photograph and electronic signature from new arrivals from next year.

It is within this context that the beleaguered UK Border Agency is being broken up (BBC). The UKBA is currently responsible for border protection, visa & passport issuance, asylum cases, immigration law enforcement, etc.

Face rec false rejects, organizational false accepts and ROI

Britain's passport and ID service seeks facial recog tech suppliers (The Register)

The Home Office plans to spend up to £16m on facial recognition technology for the Identity and Passport Service.

A tender notice in the European Union's Official Journal (OJEU) popped up this week that showed that Theresa May's department was now on the hunt for providers of a Facial Recognition Engine and a Facial Recognition Workflow for the IPS.

The article then proceeds to a brief discussion of the pros and cons of the tender. The pros follow the benefits of a facial database search before issuing new photo ID documents (click for a good example). In this case the ID documents are British passports. The cons presented in the article come in two flavors, price and performance.

The money issues are common to any governmental expenditure.

The performance issue in the article that I want to address is "false reject rate." The false reject rate of a facial recognition system in the case at hand should be taken apart and put into two categories. The first category is the performance of the core face-matching technology, the second category is the performance of the entire Home Office organization.

What constitutes a "false reject" in the core technological sense is any "match" made by the face recognition system between a submitted image and the images in the searchable database that turns out to be an incorrect/inaccurate match. In other words, "matches" that aren't real matches are false rejects.

But in this case, the Home Office is ultimately judged, by how many bad passports it issues (false accept), not by the perfection of one mechanism in a rigorous process by which the organization arrives at its go/no-go decision. After all, if my name is John Smith and I submit my passport application to the Home Office, they will probably search their databases for "John Smith." If they find several, does that constitute an automatic false reject? Does that mean I can't get a passport? Of course not. Someone will look at the list of John Smith's to see if I'm pretending to be someone else with the same name.

Here, facial recognition is used to add an image capability to go along with the search the Home Office already does with new passport applications. It is not an automated decision-making engine. Even though facial recognition systems at very large scales or in chaotic environments are very difficult to automate, they can be extremely useful investigative tools for trained users.

Humans are pretty good at matching faces with small data sets. The processes people use to identify other people with high confidence levels are extremely complex and may take into account all sorts of information that facial recognition software doesn't. People, however, aren't very good at identity management among large numbers of people they don't know.

In biometrics, the software takes in a mere fraction of the information people use. It doesn't make any inference about it, and it does its job extremely quickly by treating the problem in a way that closely resembles Nikola Tesla's famous critique of Thomas Edison: “If Edison had a needle to find in a haystack, he would proceed at once with the diligence of the bee to examine straw after straw until he found the object of his search.”

When dealing with people we don't know, humans are relegated to the needle-in-the-haystack process and unfortunately, they do it so slowly as to make it impractical with large data sets. Even if you believe that computers running facial recognition software aren't very good at recognizing people, they're way better at dealing with the problem of large populations than people are.

The assumption buried in the "false reject" critique for this face-rec application is that narrowing a list of 300,000 down to ten possible matches represents 9 failures. More accurately, because pre-face-rec no image-based comparison is being conducted at all, it represents 299,991 successes

When biometric software is used to sort a large population according to the probability of a match, then to present the list of top candidates to a person trained to detect fraudulent passport applications, the result is a fraud-detecting capability that did not exist before. So, even though facial recognition software by itself may have a "false reject" rate, it does not operate in a vacuum and will almost certainly help the organization as a whole reduce the inappropriate issuance of passports, i.e. its "false accept" rate

So we finally arrive where we should have been attempting to go all along — Return on Investment (ROI). ROI can be hard to calculate in security applications. It can also be hard to calculate for government expenditures, but ROI is where the rubber meets the road. The proposition does not turn on whether facial recognition can dictate to human beings whether or not to issue a passport. It can't, and even if it could, most people would probably be uncomfortable giving up their right to appeal to a person in a decision-making capacity. Facial recognition can certainly help people make better decisions, though, and biometrics and ID are ultimately all about people.

Does £9m Really Buy 60 Immigration Agents?

UPDATE: The same study is referenced here and here and elsewhere, I'm sure. I haven't seen anyone else dispute what seems to be an obvious example of what Tom Sawyer would have called "a stretcher."


£9m cost of eye scanning 'would have been better spent on immigration staff' (Guardian)

The report also criticises the price of the programme: "[IRIS'] sole value appears to have been that it provided data for the e-gates. This money could have been better spent on border staff - at least 60 immigration officers could have been employed with the money spent on IRIS."

Image: BBC

Sixty immigration officers for six years for £9m? That sounds like a pretty good deal. But is it true?

First, the costs: If we take the article at face value, £9m divided by 60 immigration officers since 2006 = £25,000 per officer per year. Is this realistic?

The Home Office isn't currently hiring Immigration Officers but if it was their starting salary details are available at their site: UK Border Agency: Current Vacancies. Since 1 July 2009, new immigration officers earn an annual salary of £21,947 in London and £21,505 nationally.

According to Indicator, a rule of thumb for the true, fully-loaded cost of an employee is at least 150% of their salary, and Indicator seems to be referring to the private sector where wages tend to represent a greater proportion of total compensation than in the public sector. The additional cost comes from pensions, training, employers' NI, medical insurance, etc.

Let's also assume a 2% per year pay increase (not too generous, really, but I do recall seeing that number somewhere). Taking the lower end of the fully-loaded cost estimate and the lower of the two Border Agency salaries for Immigration Officers we get a cost of £203,484.21 for the first six years of an Immigration Officer's career.

Not too bad, so far. Though at £203,484.21 per officer for six years and a budget of  £9m, the Guardian's 60 immigration officers have shrunk to 44.23 immigration officers.

Second, The benefits: Or, What do you mean by Immigration Officer?

When someone says 60 Immigration Officers for £9m, it's natural to imagine 60 shiny new immigration stations at Gatwick and Heathrow staffed and ready to go. Is this realistic?

This HomeOffice.gov document describes working hours and benefits. When you add it all up and split the difference on the 5 extra days of seniority-based annual leave, an Immigration Officer can only work 18.5% of the hours in a year (1,618 work hours vs. 8,766 hours in a year). They're only human, of course (and, of course, this is half the point of this post). But from a security and productivity standpoint, the occupied desks are the true unit of work, not the number of souls who earn their living at the Home Office.

With these numbers, staffing one Immigration Officer post, 'round the clock for one year requires 5.41 immigration officers. Staffing that single desk for six years will cost £1,101,908.91. The £9m cost of eye scanning over six years could have been spent on staffing 8.11 immigration officer posts 'round the clock for six years. 60 officers morph into 44 officers staffing 8 desks.

Staffing 8 desks for six years may have been preferable to using the IRIS system for the same amount of time but the information required to make that judgement isn't publicly available. Whatever the case, the choice was never between sixty immigration officers or iris biometrics.

The measure relevant to labor is productivity. The measure relevant to biometric systems is return on investment. Sometimes, especially in organizations such as the Home Office that don't measure success in terms of revenues and profits, the return on investment in biometric systems is revealed in the productivity of the organization's employees.

Given that the airports in question have opted to replace the IRIS system with eGates using facial recognition, it seems at least plausible that the IRIS system proved the worthiness of biometric systems and was simply displaced by a superior technology.

After all, the headline doesn't read: "IRIS System Turned Off, 60 Immigration Officers Hired."

Compromise reached on Biometric ID in India

Chidambaram says compromise reached on unique identity project (MSN - India)

The planning commission on Friday said that the Unique Identification Authority of India (UIDAI) issue has been resolved. The cabinet committee on UIDAI has also approved additional spending of Rs 5,000 crore for issuing UID cards.

P Chidambaram, Nandan Nilekani call truce on Aadhaar (Economic Times)

The Union Cabinet on Friday decided to extend UIDAI's mandate for collecting biometrics from 20 crore citizens to 60 crore citizens, thus ending a year long turf war between the Unique ID Authority of India Chairman Nandan Nilekani and Home Minister P Chidambaram over the mandate to collect data of Indian residents.

♦ UID had its mandate tripled and is to issue ID's to 600 million people.
♦ Both sides agreed to stay our of each other's way (though simple arithmetic would seem to render that impossible over the long run).
♦ UID has to make some adjustments to how NPR wants to collect the data.

I have a feeling that the rivalry between the two projects and the two men that head them will heat up again soon enough.

I think this post from Tuesday had it about right.

It looks like Chidambaram was either told in no uncertain terms to start playing nice, or was tipped off ahead of Wednesday's cabinet meeting that UID was going ahead and he figured out which way the wind was blowing on his own (See: Govt likely to extend UIDAI’s ambit). The Home Ministry is now "examining how best to include the Adhaar number into the [Home Ministry's] smart card, which will make the smart card even more feature rich." This is a good thing.

While it is inherently inefficient to have two government bureaucracies with broadly overlapping mandates, India's experience with monolithic bureaucracies that face no competition hasn't been good, either (See: UID Catch-22).

There are also some synergies between the two efforts. They can learn from each other during the massive multi-year organizational effort. The UID database can be used to audit the NPR database and vice versa. Eventually they may be combined.

It's easy to understand Home Minister Chidambaram's point of view. Unlike UID's Nandan Nilakeni, Chidambaram is a real government minister, with a big job and the power (and budget) that goes with it. It must be horribly inconvenient for a government minister to have to compete with India's most famous technology business titan especially when he gets to start from scratch and you have to steer an organizational culture you didn't create and have few mechanisms to change.

His best arguments for clipping Nilakeni's wings were always legal and procedural: UID wasn't created the right way; Parliament hadn't acted; etc. His tactics were counterproductive when he argued his case from a technical position because his technical criticisms (accuracy, fraud, etc.) consisted entirely of pointing out challenges inherent in any biometric project of this scale. They applied to UID and the NPR equally.

Hopefully this signals the end of the beginning of the creation of a key piece of 21st century Indian infrastructure.

If the two organizations can work together for the common good there will be plenty of credit to go around.

To which I would add that Indians can also benefit from a healthy rivalry between the two.

UID allowed to collect biometrics for all Indians [UPDATE: Nandan Nilekani's battle for biometrics ends with compromise]

UPDATE III (The other two are at the bottom):

IDTV has walked back their coverage at the page (linked below).
The headline now reads: "Nandan Nilekani's battle for biometrics ends with compromise" and states essentially that UID and NPR will continue in parallel with as little duplication as possible.

The original headline for the article was "UID allowed to collect biometrics for all Indians," which is still in the article's URL: http://www.ndtv.com/article/india/nilekani-allowed-to-collect-biometrics-for-all-indians-170411. [Original post follows].

NDTV.com is reporting that the Unique Identity (UID) Project will be allowed to extend its services to all Indians.

Nandan Nilekani has just scored 15,000 crores and the right to collect the biometrics for all Indians.  An informal meet chaired by Prime Minister Manmohan Singh today green-lit Mr Nilkani's request to continue collecting biometrics. The proposal had been opposed by the Home Ministry headed by P Chidambram.

The meeting is reported to be informal, so I guess it's possible UID will receive shocking news before a formal announcement, but once the Home Ministry started making noises about how they were totally cool with UID, things certainly appeared to be moving this way.

This bit of news was predicted by the Times of India here and discussed here yesterday in UID: Home Ministry Climb-down.

UPDATE: The Deccan Herald is reporting that the formal meeting will take place "next week."

The fate of Nandan Nilekani led Unique Identification (UID) project will be decided by the Cabinet Committee on Unique Identification (CCUID) next week.

The panel headed by Prime Minister Manmohan Singh is expected to sort out differences between the Union Home Ministry and the Planning Commission over collection of data.

The meeting, to be attended by Finance Minister Pranab Mukherjee, Home Minister P Chidambaram, Planning Commission Chairman Montek Ahluwalia and UIDAI chairman Nandan Nilekani, will also discuss some of the contentious issues of the project including duplication of National Population Registry (NPR) and UID, expenses, and enrollment of citizens for Aadhaar numbers.

UPDATE II: MSN India sees it differently.

UID: Home Ministry Climb-down

In today's episode of "All UID, All the Time," India's Home Minister Chidambaram announces that "There were media reports about conflict between the home ministry and the UIDAI, but they are not true," and “There is no clash between Adhaar and the smart card issued by the Home Ministry.”

[You may take a moment to retrieve your monocle.]

It looks like Chidambaram was either told in no uncertain terms to start playing nice, or was tipped off ahead of Wednesday's cabinet meeting that UID was going ahead and he figured out which way the wind was blowing on his own (See: Govt likely to extend UIDAI’s ambit). The Home Ministry is now "examining how best to include the Adhaar number into the [Home Ministry's] smart card, which will make the smart card even more feature rich." This is a good thing.

While it is inherently inefficient to have two government bureaucracies with broadly overlapping mandates, India's experience with monolithic bureaucracies that face no competition hasn't been good, either (See: UID Catch-22).

There are also some synergies between the two efforts. They can learn from each other during the massive multi-year organizational effort. The UID database can be used to audit the NPR database and vice versa. Eventually they may be combined.

It's easy to understand Home Minister Chidambaram's point of view. Unlike UID's Nandan Nilakeni, Chidambaram is a real government minister, with a big job and the power (and budget) that goes with it. It must be horribly inconvenient for a government minister to have to compete with India's most famous technology business titan especially when he gets to start from scratch and you have to steer an organizational culture you didn't create and have few mechanisms to change.

His best arguments for clipping Nilakeni's wings were always legal and procedural: UID wasn't created the right way; Parliament hadn't acted; etc. His tactics were counterproductive when he argued his case from a technical position because his technical criticisms (accuracy, fraud, etc.) consisted entirely of pointing out challenges inherent in any biometric project of this scale. They applied to UID and the NPR equally.

Hopefully this signals the end of the beginning of the creation of a key piece of 21st century Indian infrastructure.

If the two organizations can work together for the common good there will be plenty of credit to go around.