US: Face recognition code of conduct confab loses privacy advocates

The National Telecommunications and Information Administration (NTIA) has convened a privacy multistakeholder process regarding the commercial use of facial recognition technology. On December 3, 2013, the NTIA announced that the goal of the second multistakeholder process is to develop a voluntary, enforceable code of conduct that specifies how the Consumer Privacy Bill of Rights applies to facial recognition technology in the commercial context.

Privacy Advocates Walk Out in Protest Over U.S. Facial-Recognition Code of Conduct (The Intercept)

“At a base minimum, people should be able to walk down a public street without fear that companies they’ve never heard of are tracking their every movement — and identifying them by name – using facial recognition technology,” the privacy advocates wrote in a joint statement.

The quoted article is full of links to NTIA online resources.

An "open letter" of resignation on the part of the named privacy advocates lists their concerns here.
Concluding paragraph:

We hope that our withdrawal signals the need to reevaluate the effectiveness of multistakeholder processes in developing effective rules of the road that protect consumer privacy – and that companies will support and implement.

Ultimately, of course, these are political questions rather than technological ones, but the focus on one type of technology (facial recognition) is a little difficult to understand. If it's wrong for a private corporation to track an unsuspecting individual's every movement, identifying them by name, why single out facial recognition (the means) rather than the tracking (the end)?

The privacy advocates, however, have a point in their favor. The effectiveness of confabs of privacy advocates, sub-cabinet-level administrators, and corporate executives in defining a society's scope for privacy in public should be questioned.

Also mentioned in the article is the fact that the states of Texas and Illinois have passed laws limiting the use of facial recognition technology to identify individuals in public without their affirmative consent.

UK: Leicestershire police trial face recognition at music festival

Download Festival: Facial recognition technology used at event could be coming to festivals nationwide (The Independent)

Around 90,000 people attending the five-day rock event in Derby will have their faces scanned by “strategically placed” cameras, which are then compared with a database of custody images across Europe.

The force has trialled the system since April 2014 in “controlled environments”, but this is the first time the portable NeoFace surveillance technology, made by NEC Corporation, is being used outdoors in the UK on this scale.

Leicestershire police said it hoped the system would enable them to find organised criminals who prey on festivalgoers who are often victims of theft.

This sounds a lot like the 'Snooper Bowl' deployment we had a role in back in 2001.

Facial recognition surveillance in an uncontrolled environment with non-participating individuals still presents significant technical challenges. Among them are lighting, pose angle, and perhaps most significantly, training users on how to evaluate the information the facial recognition system generates.

See also: Leicestershire Police defend facial recognition scans (BBC)

Face rec vs. the knockout game

Philadelphia teen arrested in filmed knockout punch of SEPTA passenger (New York Daily News)

Facial-recognition software reportedly helped collar a 16-year-old boy in Monday's violent Philadelphia subway attack that left a 60-year-old man knocked out cold and suffering a broken jaw.

Kenya removes 12,500 from public payroll following biometric enrollment

12,500 workers struck off payroll after vetting snub (Business Daily)

More than 12, 500 civil servants were Monday struck off the payroll after they failed to list afresh during the two-month registration exercise that was aimed at weeding out ghost workers.

That's like, so 2001

MAY, 2013
Boston PD Tested Facial Recognition Software By Recording Every Face At Local Music Festivals (Daily Caller)

Concertgoers at last year’s annual Boston Calling music festivals weren’t just there to watch the show — they were watched themselves as test subjects for Boston police’ new facial recognition technology, which reportedly analyzed every attendee at the May and September two-day events.

Employees at IBM — the outside contractor involved in deploying the tech alongside Boston Police — planned the test of its Smart Surveillance System and Intelligent Video Analytics to execute “face capture” on “every person” at the concerts in 2013.

FEBRUARY, 2001
Welcome to the Snooper Bowl (Time)

In a move that has been both hailed and decried, the Tampa Bay police department used the occasion of Super Bowl XXXV to conduct a high-tech surveillance experiment on its unsuspecting guests. In total secrecy (but with the full cooperation of the National Football League), the faces of each of the games' 72,000 attendees were scanned and checked against a database of potential troublemakers. The news, first reported in the St. Petersburg Times, raises some urgent questions: is this the end of crime--or the end of privacy?

The surveillance system, FaceTrac, is based on technology originally developed at the Massachusetts Institute of Technology to teach computers to recognize their users, and was installed by a Pennsylvania firm called Graphco Technologies.

The technology and key personnel from Graphco were acquired by SecurLinx in 2003.

Governor of Bayelsa, Nigeria to State employees: No biometrics; no paycheck.

Workers not captured by biometric will forfeit salaries –Dickson (National Mirror)

Bayelsa State Governor, Seriake Dickson, yesterday warned that civil and public servants not captured in the ongoing verification and biometric exercise would forfeit their salaries from January next year.

Poll: Public not too worried about surveillance and face recognition

Americans mostly in favor of facial recognition at public events: poll (Biometrics Update)

From the report, 59% oppose email and cell phone surveillance (up 13% from 2006), but 79% are in favor of using facial recognition at various locations and public events and 81% support expanded camera surveillance on streets and in public places.

The public probably senses that there are a lot of ways to deploy facial recognition that are much less invasive of privacy than snooping on emails and hacking cell phones.

Putting the mosaic together in Boston

The post's title refers to the mosaic of information that can be arranged into a picture of the events leading up to the savage acts. The other mosaic, the way things were for so many unique individuals, can never be put back together.

How This Photo of the Boston Marathon Gives the FBI a Bounty of Data (Wired)

The photo — click to enlarge — shows a lot of people, what they’re wearing and where they’re positioned within the crush of Marathon fans. It’s important to law enforcement, as it “can be of use in putting the mosaic together,” says Robert McFadden, a former Navy terrorism investigator. Crabbe’s wide-angle panoramic photo “could be one of the many critical pieces of the map of the investigation.”

The panorama photo was one of seven shots Crabbe snapped with her phone during a leisurely stroll and later handed over to investigators.

The Wired article starts with a single data point (data set, really), a photo, and follows it part-way through the process the FBI has used during its investigation of the recent bombings in Boston.

...putting the mosaic together. It's a good metaphor for how the people charged with figuring out what happened and who did it go about their work. Read the whole thing.



Also see:
What's Going on Behind the Scenes of Bombing Investigation? Forensic Scientist, Former DHS Official Shed Light on Tech and Tactics (The Blaze)

“Facial recognition technology will play a very small part,” Schiro told TheBlaze in a phone interview.

“A lot depends on the quality of the images you have to work with,” Schiro continued noting that lighting, angle and other factors could really limit the use of facial recognition in the case. Not only that but there would need to be some sort of match for it to recognize.

UPDATE:
Here's another good article about facial recognition and crime solving. I selected the two paragraphs below because they highlight both the organizational issue of interoperability and the technology issues around matching. There are other interesting insights in the rest of the piece.

Facial Recognition Tech: New Key to Crime Solving (The Fiscal Times)

However, it's likely the FBI was unsuccessful in identifying the suspects using FR because either they didn't have a quality image of the wanted persons, or the suspects were not in any of the databases the FBI has access too, Albers said.
...
While facial recognition technology has high-accuracy when used to match a clear image of a person with another passport-style photo, it is not as effective when used with low-quality images like the ones the FBI released on Thursday. The standard for facial recognition to be accurate requires 90 pixels of resolution between the two eyes of the pictured person. The pictures the FBI released of the suspects were about 12 pixels between the two eyes, said Jim Wayman, the director of the National Biometric Center.

and..
Facial-recognition technology to help track down criminals – Humans are still better at it (Kuwait Times)

Search for Boston bombers likely relied on eyes, not software (Reuters)

These last two reminded me of the (Facial Recognition vs Human) & (Facial Recognition + Human) post from November 2011.

In the Boston case, it looks like there were two barriers to effective use of facial recognition technology in identifying the suspects. On the "evidence" (probe) side, the image quality was poor. On the enrollment (database) side the only "correct" match was likely to be in a very large database such as the Massachusetts DMV database.

If only one of these conditions were true — for example a bad probe against a small database, or good probe against a large database — facial recognition technology might have been of more help.

Crowd-sourcing the ID challenge to a large number of human beings that operate with a lot more intelligence and information than facial recognition algorithms is another option. It's been used with photographs since at least 1865 and without photographs since at least 1696.

One crowd-sourcing fact that law enforcement officials must consider, however, is that the suspect is almost certainly in the sourced crowd. If the suspect already knows he's a suspect, that's not a problem. If he doesn't already know he's suspected, that information is the price of getting the public's help which means facial recognition technology will retain its place in the criminal ID toolkit.


UPDATE:
Boston police chief: facial recognition tech didn’t help find bombing suspects (Ars Technica)

“The technology came up empty even though both Tsarnaevs’ images exist in official databases: Dzhokhar had a Massachusetts driver’s license; the brothers had legally immigrated; and Tamerlan had been the subject of some FBI investigation,” the Post reported on Saturday.

Facial recognition systems can have limited utility when a grainy, low-resolution image captured at a distance from a cellphone camera or surveillance video is compared with a known, high-quality image. Meanwhile, the FBI is expected to release a large-scale facial recognition apparatus “next year for members of the Western Identification Network, a consortium of police agencies in California and eight other Western states,” according to the San Jose Mercury News.

UK Surveillance Commissioner Speaks

CCTV Technology has ‘Overtaken Ability to Regulate it’ (Wall Street Journal)

“A tiny camera in a dome with a 360-degree view can capture your face in the crowd, and there are now the algorithms that run in the background. I’ve seen the test reviews that show there’s a high success rate of picking out your face against a database of known faces.”

Research into automatic facial recognition being carried out by the Home Office has reached a 90 per cent success rate, he said, and it was “improving by the day”.

The headline quote comes from this more detailed article from The Independent, and might best be taken as a warning rather than a statement of fact. After all, if meant literally, the statement belongs in a resignation letter.

Surveillance Commissioner Andrew Rennison:

Let's have a debate – if the public support it, then fine. If the public don't support it, and we need to increase the regulation, then that's what we need to do."

Sounds like Transparency and Consent to me.

Implications of Ubiquitous Biometric Technology

A couple of good articles discussing the implications of ubiquitous biometric technology are out today...

Does rise of biometrics mean a future without anonymity? (Contra Costa Times)

"There are multiple benefits to society in using this form of identification," said Anil Jain, a Michigan State University computer science and engineering professor, adding the technologies could prove "transformative."
...
With face recognition, for example, "in 10 years the technology is going to be so good you can identify people in public places very easily," said Joseph Atick, a face-recognition innovator and co-founder of the trade group International Biometrics & Identification Association. But misusing it could result in "a world that is worse than a big-brother state," he warned, adding, "society is just beginning to catch up to what the consequence of this is."

Businesses to use facial recognition (The Advocate)

Imagine arriving at a hotel to be greeted by name, because a computer has analyzed your appearance as you approached the front door.

Or a salesman who IDs you and uses a psychological profile to nudge you to pay more for a car.

A look at digital government services

Of course, I'd say policy and technology must be good bedfellows...

Policy and technology can be good bedfellows (The Guardian)

Technology-enabled reform of public services can create friction, as the public is required to adapt to new platforms for interacting with the state and its administrators have to learn a new way of working. At its worst, this friction can result in disjoined state paralysis following the wrong kind of policy making and subsequent commissioning. At its best, it can reduce the state running costs and better fit the mould of citizens' lives, such as being able to book a GP appointment via a laptop or mobile.

Following Attendance Scandal São Paulo City Council Self-Imposes Biometric System

After scandal, 42 of the 55 councilors say they are in favor of presence only with digital (O Estadão de São Paulo)
Google Chrome Translation (with slight edits)

After [this newspaper] uncovered fraud in the attendance record at City Hall, 42 of the 55 councilors said they were in favor of attendance at plenary sessions being recorded only by fingerprint. To change the bylaws of the house, you need the backing of 28 MPs.

The current system relies on passwords.

How to Inoculate Against Public Facial Recognition

How to Defend Yourself Against Facial Recognition Technology (PBS)

Facial recognition technology [FRT] is now just about everywhere we are...

Do we simply have to accept this as inevitable, or are there things we can do to protect ourselves and others against improper or repressive use of FRT?

Below are some tactical and technological defenses against FRT. Specifically, two layers of those involve: 1) when we are being watched, for example, at protests or in a public space, and 2) when we ourselves are taking and sharing images of others, especially online.

This well sourced-article contains a wealth of information and links having to do with in person and online public facial recognition.

Of course, CV Dazzle gets plenty of attention, as it should.

The app that automatically pixelates the faces in pictures users take with their mobile phones is really cool, too.

Then there's the software in "Friends" a threat to your privacy? This facial recognition app might help, which isn't mentioned in the PBS piece, but it would fit right in.

Canada: Strange Things Afoot at the British Columbia Privacy Commissioner's Office

Canada: British Columbia Privacy Commissioner Says No Drivers License Facial Recognition Searches for Law Enforcement Without Court Order

First some background:

From Wikipedia:

The 2011 Vancouver Stanley Cup riot was a public disturbance that broke out in the downtown core of Vancouver, British Columbia, Canada on Wednesday, June 15, 2011. The riots happened immediately after the conclusion of the Boston Bruins' win over the Vancouver Canucks in game seven of the Stanley Cup Finals, which won the Stanley Cup for Boston. At least 140 people were reported as injured during the incident, one critically; at least four people were stabbed, nine police officers were injured, and 101 people were arrested that night, with 16 further arrests following the event.

Dramatic Photos Here

Enter the Insurance Corporation of British Columbia (ICBC), which administers the province's drivers license aparatus:

Insurance corporation offers to help ID rioters (CBC - June 18, 2011)

The Insurance Corporation of B.C. is offering Vancouver police the use of its facial recognition software to aid in the investigation into Wednesday night's riot.

Troubled by the ICBC's offer, the British Columbia privacy commissioner launched an investigation. The Office of the Information and Privacy Commissioner (OIPC) is independent from government and monitors and enforces British Columbia's Freedom of Information and Protection of Privacy Act (FIPPA) and Personal Information Protection Act (PIPA).

That's the background and the primary actors.

The BC privacy commissioner has now issued a press release of her findings:

ICBC cannot use facial recognition to identify Stanley Cup rioters without a court order, says B.C.’s Privacy Commissioner (OIPC Press Release - pdf)

The Insurance Corp. of British Columbia cannot use facial recognition to identify Stanley Cup rioters without a court order, B.C.'s privacy commissioner said in a report released Friday.

A passage of critical importance states:

Next, the commissioner reviewed ICBC’s offer to Vancouver Police, and found that using the database in this manner is not authorized under FIPPA.

“A public body can only use personal information for the original purpose it was collected, except in very limited circumstances. ICBC’s offer to use its database to check police-submitted images is clearly a different purpose,” said Denham.

The commissioner’s findings do not alter the power of police to request personal information from public bodies to assist in a specific investigation, or through the use of a subpoena, warrant or court order, as per section 33 of the act.

The part of the FIPPA law the privacy commissioner cites in support of her finding that the ICBC can't cooperate with the police without a court order actually says:

Section 33 - A public body may disclose personal information in its custody or under its control only as permitted under section 33.1, 33.2 or 33.3.

Section 33.2 A public body may disclose personal information referred to in section 33 inside Canada as follows:

Section 32.2(i) to a public body or a law enforcement agency in Canada to assist in a specific investigation

Section 32.2(i)(i) undertaken with a view to a law enforcement proceeding, or
Section 32.2(i)(ii) from which a law enforcement proceeding is likely to result;

To summarize, the law states that: A public body may disclose personal information inside Canada to a law enforcement agency in Canada to assist in a specific investigation undertaken with a view to a law enforcement proceeding, or from which a law enforcement proceeding is likely to result.

So, a public body can only use personal information for the original purpose it was collected, except in very limited circumstances; those circumstances are described in section 33 of the act which clearly permits the sharing of information with police (and, really, any other government official for nearly any reason; see for yourself), yet here is precisely where the OIPC "finds" that the ICBC is prevented from cooperating without a court order when the term "court order" is never used in either of the two acts that give the OIPC its power.

As stated earlier, the OIPC is independent from government and monitors and enforces British Columbia's Freedom of Information and Protection of Privacy Act (FIPPA) and Personal Information Protection Act (PIPA).

The PIPA (Sections 52 & 53) gives the OIPC the power to issue orders which are binding unless they are appealed within thirty days.

But the OIPC's news release never asserts that the OIPC is ordering anything. The OIPC writes:

In a public report released today, Information and Privacy Commissioner Elizabeth Denham found that any use of ICBC’s facial recognition technology to identify criminal suspects requires a warrant or court order. [Emphasis mine].

Either of the bolded portions could have used the order/ordered terminology if that was what was intended by the British Columbia privacy commissioner, but they didn't.

So what exactly is going on here?

Is the OIPC ignoring its stated powers because issuing an order would lead to an appeal that the OIPC would, in the plain reading of the Act, be certain to lose?

Is the OIPC trying to take the position that if the police ask, the ICBC can co-operate, but that the ICBC can't preemptively offer help?

The OIPC's Summary of Recommendations in the document is rather telling.

1. ICBC should clearly notify customers that facial recognition technology is in use for the purposes of detecting and preventing driver’s licence fraud...
2. ICBC should immediately cease using their facial recognition database to identify persons in images provided by police, unless authorized by a subpoena, warrant or court order.
3. ICBC should establish accountability and leadership on privacy within the corporation, to ensure that privacy is taken into account in decision-making at the executive level.
4. ICBC should implement a privacy impact assessment policy, to set out when and how a privacy impact assessment is completed and reviewed. Technology projects should be reviewed at the conceptual, design AND implementation phases.
5. ICBC should develop a schedule for periodic review of its privacy policies. [Point 1 truncated, bold emphasis mine.]

If the OIPC believes that the ICBC is or was in violation of either the PIPA or FIPPA laws, doesn't it have a duty to order the ICBC to comply with the two acts and be prepared to go to court over its stance?

Perhaps another portion of the FIPPA law has more bearing in this case.

Part 2 - Division 4 states:

Information must be disclosed if in the public interest [emph. in orig.]

25 (1) Whether or not a request for access is made, the head of a public body must, without delay, disclose to the public, to an affected group of people or to an applicant, information

(a) about a risk of significant harm to the environment or to the health or safety of the public or a group of people, or
(b) the disclosure of which is, for any other reason, clearly in the public interest. [emph. mine]

The ICBC would be expected to make the argument that informing the police of its capabilities to assist them in quelling riots is not prohibited by the FIPPA law, but rather it is required by it.

Tennessee County Debates Biometric Time-and-Attendance for Sheriff's Department

County wrestles with payroll system (Daily Herald - Maury County, TN)

Using the automated payroll system, some employees would be able to log in daily at their computer, while others who don’t always have access to a terminal — including sheriff’s deputies, highway department, solid waste and central maintenance employees — would be able to clock in using a biometric reader that scans their fingerprints.

The time sheets that employees now fill out are reviewed by their supervisors and then sent to the budget office for tabulation. Maury County Budget Director Jim Bracken estimated an automated payroll system could save the county $400,000 a year by eliminating inefficiencies.

The system would cost $97,000 annually, Bracken said.

Smaller media outlets routinely do a superior job at elucidating the issues that determine the desirability of biometric deployments. The issues on both sides are important. The Return on Investment implicit in the above quoted text ($400,000 - $97,000 per year) should be balanced against arguments appearing elsewhere in the article.

Also, don't miss the article's comments.

Malta: €1 Million Attendance system to crack down on public service absenteeism

Skiving off work in the public service is soon to become far more difficult (Malta Independent)

Burgeoning Facial Recognition: How come no pitchforks?

In the previous post, I linked an article about how facial recognition technology is really taking off.

M2SYS, made very subtle observation on the article:

In other words, "How come no pitchforks?"

He's right. New technology is often feared. In the case of biometrics, there have been those who have seen fit to feed that fear. Biometrics' association with security, and hence, authority would seem to put it right in the nexus between fear and fearmongering. Furthermore, the article's author chose examples of facial recognition applications that have gotten a lot of public attention and might be considered avant-garde to say the least. But so far, most public reaction seems to come somewhere between "cool" (Scene Tap), "that was dumb" (Facebook), or "about time" (London riots). Public comment has been rather moderate and even in tone. What gives?

I think there are several reasons why new facial recognition deployments are rarely met with scorn. Some are related to what it means deep-down to be human, and some are more practical.

♦ Except in a very narrow sense and among a very few cultures, a face is not, nor has it ever been, considered private. In the vast majority of times, places and cultures it has (like "name") always served as a proxy for an individual public identity. This fact is embedded in languages and useage all over the world. "He can't show his face around here anymore." "She really lost face." "They tried to save face."

♦ It's also probable that the vast majority of people intuitively understand the difference between privacy and anonymity. Privacy is the ability to keep things about yourself secret. Anonymity means "without a name". Privacy is a time-honored value that is nearly universal in city-building societies. Anonymity, freeing one from public scorn for one's non-private actions, has probably only been accessible to the masses in the relatively narrow space between the industrial revolution (that enabled rapid transit and the megalopolis) and the information age which seems to be making anonymity much harder.

♦ Marketers aren't stupid. When interractions aren't strictly voluntary, anonymity can act as a salve and biometrics can improve the efficacy and customer experience of marketing. Marketers know this and in a competitive marketplace the cost of mistakes is high. [After I've read it as well, and assuming the Phillip K. Dick story is similar to the movie, I'll write a detailed piece on how those who use Minority Report to say anything serious about biometrics profoundly misunderstand both Minority Report and biometrics. In the movie, the advertising posters were calling the name of John Anderton's eyeballs' former owner. Not only did this make the ads useless, it was also super-annoying to John Anderton. I would never go in a store where that happened and I doubt I'm alone.] The type of technology driving the variable ads is nothing like Minority Report. In fact, it's not really face recognition in the first place. It's really more demographic (in the marketing sense) recognition. It's non-individual (anonamous even) which is what makes demographics useful. And it's helpful. Even without biometrics, I see fewer ads for products I am not in the market for. Now if biometrics can just do something about all the perscription drug and trial lawyer commercials, I'm all for it.

♦ There have been no high-pofile victims of facial recognition gone awry — not that there won't be. It's easy to imagine that someone in a witness protection program or a high-value political defector might be tracked down and murdered in part using a facial recognition dragnet. Those people may want to swing by the CV Dazzle site for some face-rec-beating fashion tips. But it hasn't happened yet.

♦ Last (for now) but not least: After 9/11 there was a lot of overpromising an underdelivering about biometrics. A lot of money changed hands and a lot of people got egg on their faces. Still, they say "it's an ill wind that blows no good." The up-side of this bad history is that the public has had ten years to get used to the idea of what facial recognition applications are only just now begining to deliver. I think there's a sense among the public, at least on the security side, of: "I thought they were doing that already."

CV Dazzle: Public Anonymity through Fashion

Camouflage from Computer Vision (CVDazzle.com)

CV Dazzle is camouflage from computer vision (CV). It is a form of expressive interference that combines makeup and hair styling (or other modifications) with face-detection thwarting designs. The name is derived from a type of camouflage used during WWI, called Dazzle, which was used to break apart the gestalt-image of warships, making it hard to discern their directionality, size, and orientation. Likewise, the goal of CV Dazzle is to break apart the gestalt of a face, or object, and make it undetectable to computer vision algorithms, in particular face detection.

In response to the increasing popularity and dependability of facial recognition systems, there is an avant garde movement that seeks to join computer programmers, fashion designers, and stylists in an effort to maintain the option of public anonymity in a world of public facial recognition.

You have to admit, this

Photo: CVDazzle.com

 is a way more interesting way to thwart face rec than this.

Photo: Bank of America

Check out their site. There are a lot of cool images there — sort of  Lisbeth Salander meets nouveau punk — as well as some good information about face recognition.

But what happens to the future Dazzler who wants to use a multi-modal face and voice recognition ATM on the way to their face rec-accessible office?

Brazilian police to use Face-Rec eye glasses at World Cup

Brazilian police will use futuristic 'Robocop-style' glasses fitted with facial recognition equipment to identify and root out troublemakers at the 2014 World Cup (Telegraph.co.uk)

Major Leandro Pavani Agostini, of Sao Paulo's Military Police, said: "It's something discreet because you do not question the person or ask for documents. The computer does it.

I'd like to know more about this proposed deployment.

UPDATE: Twitter bot Bixby Snyder: I'd buy that for a dollar!
I should have thought of that!

UPDATE II: Since this has gotten so much attention, I think it's appropriate to add a little to this post.

The effective use of facial recognition technology in a surveillance environment requires significantly more training, environmental control (or compensation for environmental factors), and user judgment than other biometric modalities that depend on voluntarily user interaction.

2014 is still a long way away, but I suspect what is being discussed is a re-run of the "Snooper Bowl" experiment featuring our very own FaceTrac in 2001.

If the "Robocops" involved act as anything more than discreet mobile tripods, I'll be surprised.

Iris Biometrics in the news

Iris recognition may move from movies into the real world (Pittsbutgh Post-Gazette)

Biometric technology such as iris recognition uses physical characteristics -- including facial shape, fingerprints, retinal photos and iris patterns -- to confirm identities. The technology works by photographing the iris, the colored membrane that controls how much light reaches the retina, and converting the picture into a computer code. The code is compared with one in a database.

In 1936, a St. Paul, Minn., ophthalmologist named Frank Burch proposed identifying people using the furrows, ridges, rings and freckling that make every iris unique. But it wasn't until 1987 that eye doctors Leonard Flom and Aran Safir were granted a patent for the concept of the identification technology.

A Company Seeks Ubiquitous Iris Scans On PCs, ATMs and Cell Phones (PopSci.com)

Like fingerprints, every person’s irises are different; not even both irises of the same person are the same. Fingerprints can take a while to verify through state and national databases, but an iris scan, which uses more data points for biometric identification, can come up with a match within a few seconds. Those are the pros, if you’re a security expert. But they’re minuses if your concern is privacy. Fingerprints, by their very nature, are an active identification metric; you have to touch something to imprint them. But iris scans are passive — you just walk past a security camera (or, as in “Minority Report,” billboards in the mall) and the person controlling the scanner can spot your identity within seconds.

The Pittsburgh Post Gazette article is straightforward and informative.

The PopSci article reads like a press release masquerading as news.

The facts the PopSci article presents seem a bit off, too.

It has always been the case that iris matching is slower than fingerprint matching. That's why it's popular in jails, where the customers aren't in much of a hurry. In places where throughput is a primary concern, such as school lunch counters, fingerprint biometrics have been more popular.

The author says that the iris match is faster because it uses more data points. That's not really the way computers work. Other things being equal, processing more data points takes more time.

Iris matching technology is highly accurate. More accurate, even, than fingerprints. In a side by side comparison between iris and finger with participating individuals where speed is not a factor, iris wins hands down.

There are many applications where iris is the preferred modality for an identity management application. But like we said yesterday, there is no magic bullet in identity management.

Iris at a distance, as discussed in the article, moves the goalposts and offers intriguing possibilities. But, especially in this industry, it is important to avoid over-promising and under-delivering.

For some background on how the company referenced in the article sees the future and their current capabilities, see the Fast Company article from last August: Iris Scanners Create the Most Secure City in the World.