Insight into Google's Ideas about Security

Googling from the inside out (Smart-Grid.TMCNet.com)

The article is about Google's Pryor, Oklahoma data center. A large section, however, is devoted to Google's and the center's approach to security.

The relevant paragraph is the longest one. It begins:

"We take security and privacy very seriously which is why our facilities are not something we have regular tours through," he said. "This is why we have the kind of fencing which you might see at a medium-security prison, because if that trust (in Google) goes away, it would be very difficult for us to get it back." "Besides the fencing and the gate, we have an extensive security system," Wooten said. "Of course, we have security cameras, highly controlled badge access in biometrics to the facility and specific parts of the facility which are more sensitive, iris scans, fingerprint scans, and even restricted access to other 'Googlers' -- only the people who are authorized to be in a certain location have access. Even people from other Google data centers, there are five in the U.S., don't have clearance to our center -- security is that tight."

Ukraine: Biometric Passports & Visa-Free EU Travel on the Horizon

Azarov: Ukraine to establish visa-free regime with EU within two years (Kyiv Post)

Ukraine already has visa-free regimes with many countries. The process towards more liberalized visa regimes with other countries will continue, he added.

The article's comments aren't as optimistic.

Prototype "Rapid" DNA

Could bolster forensic investigations (Computerworld)

All that's needed is to insert the type of swab now widely used to collect DNA often from inside a cheek into the DNA-analysis kit and within 90 minutes, out pops the answer to what an individual's DNA is (not a full genetic analysis but what suffices for identification and perhaps confirming family relationships such as parent-child or sister-brother).

The goal is to get RapidHIT, a portable box-like device with integrated bio-science reagents, chipset, software and applications down to an hour. Jovanovich said there's been field testing with the Palm Bay, Fla., police department. Even the Department of Defense has taken the RapidHIT device to test it with Army volunteers in a Norfolk field exercise in May, he added, noting that one Army officer brought a swab from his son to see what the DNA-linked paternity outcome to him would be (he wasn't disappointed).

If it's all that's available, and often it is, DNA analysis is an extremely valuable tool. Occasionally, time is of the essence and DNA is the only option. The full article describes the efforts of several organizations to return DNA results more quickly.


And then, there's this:

One pent-up need for a rapid DNA analysis kit is coming for the Department of Homeland Security's citizenship and emigration services, according to Christopher Miles, biometrics program manager at DHS.
...
The uncomfortable realization that the government might be wasting a huge amount of time reading fraudulent documents and listening to lies was a lesson learned a few years ago in trying to help refugees in Kenya that wanted to emigrate to the U.S. In that instance, the U.S. government took about 500 DNA samples, did a lab analysis to verify family relationships, and found out 80% were fraudulent, Miles said.

Biometric modalities are interesting. Different ones are good for different things. No other modality can determine biological family relationships which, in certain circumstances, are very important.

It's not clear that "rapid" is necessary in this application because the gating factor on how long the immigration process takes isn't the time required for DNA testing. The ROI on shortening the turn-around time on a DNA test may not be there, but that 80% number is staggering.

Because "rapid" isn't that rapid and interacting with the biometric sensor is awkward, DNA, as a biometric modality is likely to remain at the "high value, low volume" end of the spectrum for a long time to come.

India: Insight into the Bureaucratic Struggle for UID

Nandan Nilekani defends Aadhaar (Economic Times)

Unique Identity Authority of India (UIDAI) chairman, Nandan Nilekani, vigorously defended his body against criticism from various government departments and dismissed concerns about the lack of checks and balances in its functioning. Nilekani is expected to meet prime minister Manmohan Singh to set the record straight about the Authority's operations. He will also meet Planning Commission chairman Montek Singh Ahluwalia early next week.

The Economic Times has been doing excellent work in keeping up with UID.
The Hindustan Times also weighs in: UIDAI, Plan panel refuse to budge; fight still on

See also: Aadhaar valid to open bank account (The Times of India) which describes some of the nuts-and-bolts of how the ID opens up access to services such as banking, phone and utilities.

Recent Posts:
India: Is UID Under Siege?
India: UID is the Easy Part

Nigeria to Implement National Biometric ID

FEC okays N30.66bn for new national identity card (Vanguard)

THE weekly Federal Executive Council, FEC, yesterday rose from a prolonged session with an approval for the National Identity Management Commission, NIMC, to embark on the provision of an electronic national identity card for all Nigerians of 18 years old and above, at the cost of N30.66 billion.

The FEC meeting which was presided over by President Goodluck Jonathan, with Vice President Namadi Sambo, said the project entails the development of a comprehensive, biometric database for all Nigerian adults.

30.66 billion Nigerian Naira = $191.56 million US (link)

Nigeria has already devised a biometric voter register. See: Nigeria Voter System and Implementation Update

Other posts on Nigeria

Will Advanced Biometrics Automate Future War Machines?

"Tactical non-cooperative biometrics" raises troubling questions (CIO Magazine)

Biometric security breakthroughs are coming that would let the military capture from a distance an iris and facial scan of an individual and immediately match it to a biometrics-based "Watch List" of suspected terrorists, combatants or criminals.

Included Topics:
♦ Sensors mounted on flying aircraft drones
♦ Automated killing in war based on "tactical non-cooperative biometrics"
♦ Surveillance and watch lists
♦ Ethnicity & Gender identification
♦ Hardware & Software

All technological advances force societies to choose which applications of the new technology are acceptable. This article does a pretty good job of outlining some of the more exotic military possibilities opened up by biometrics, but it also shows that the military's thinking on acceptibility is pretty advanced, as well.

Voice of America: India Requires Citizens to Register for Biometric Identity Number

Ambitious project (Voice Of America)

Until some months ago, a resident of a poor neighborhood in New Delhi, college student Ashok Kumar, 21, faced a problem. With no identification such as a passport or a driving license, mobile phone operators refused to give him a number.

That changed when Kumar was issued a 12-digit number as part of an ambitious project to give every Indian citizen a biometric identity.

He says with this number as proof of his identity, he was issued a mobile phone number. He has opened a bank account. And when he traveled to Bangalore recently, he showed his biometric number when asked to prove his identity.

Ignoring the headline, the article is a solid summary of the program and the benefits it aspires to confer.

But for now, UID only has a mandate for enrolling 200 million people. Given India's population, and assuming the use of plain language, it's hard to square the headline's assertion that UID is required — although it is obviously highly desirable to many people such as Mr. Kumar.

Perhaps it should be required. Perhaps it will eventually be required. Perhaps the headline writer is conflating the census with UID. Perhaps it's a far more mundane mistake. But it's hard to see how UID enrollment is required at the present.

Anyway, it's probably just a mistake. The article itself is quite good.

Ghana Biometric Voter Registration

The Ghanaian Electoral Commission's selection of a vendor for its biometric voter registration exercize has been getting a lot of attention lately. Click this Bing news search for "ghana biometric voter" for a sample.

After reading a few of these stories it becomes clear that there are significant challenges involved in the implementation of the biometric register. But more interesting is the challenge Ghana doesn't face: reaching a consensus that a biometric voter system is desirable.

Ghanaians are extremely proud of their democracy and they are keen to protect and deepen it. They also overwhelmingly support the effort to reinforce the keystone of democracy, free and fair elections, with a well conceived, implemented and managed biometric voter management system.

Health Care, Time-and-Attendance & ROI

Basildon and Thurrock University Hospitals NHS Foundation Trust deploys SMART to streamline processes and reduce costs (Press Release)

Basildon and Thurrock University Hospitals NHS Foundation Trust is using SMART, provider of solutions for workforce management, to streamline processes that save time and money and release valuable resources back to patient care. To date, the Trust has deployed SMART’s e-Rostering, Time & Attendance and eExpenses software to support 1,800 clinical staff including 1,500 nurses and plans to expand the system to the rest of the organisation by July 2012. Since implementing SMART, Basildon and Thurrock University Hospitals NHS Trust has generated savings of nearly £500,000 per year.

Before SMART, Basildon and Thurrock University Hospitals NHS Foundation Trust relied entirely on manual processes to record staff time, administer shifts and expenses claims. This approach was not only labour intensive but it was prone to errors. At the same time, the Foundation Trust faced the same challenges as most NHS organisations to reduce costs.

Denial of funds to UIDAI not a setback: Nandan Nilekani

Current Funding to Cover 200 Million Enrollments (Economic Times)

"One of our biggest supporters, the finance minister has been extremely gracious and supportive, and he has always sent me the message that we should do this as fast as we can," Nilekani told reporters at the first anniversary of Aadhaar launch.

"What the finance ministry has done is that essentially they had said that you can enrol up to 200 million and beyond 200 million the cabinet has to decide what the exact modality will be. We have absolutely no issues and we have got fantastic support from the finance ministry," he added.

This follows upon Tuersday's post: India: Is UID Under Siege?

New York: Seven Arrested For Alleged SAT Cheating Ring UPDATE: SAT, Biometrics & ROI

Educator: Pressure On Kids Massive; Attorney: District, Not Courts, Should Rule  (CBS - New York via Drudge)

Eshaghoff, who graduated from the high school in 2010 and is currently enrolled at Emory University in Atlanta, was paid between $1,500 and $2,500 per student. He has been arrested and charged with scheme to defraud, falsifying business records and criminal impersonation.

There's big money at stake in administering the test and there's big money and status at stake in obtaining a high score on the test. Many standardized tests use biometrics in order to increase the integrity of the test results.

After all, only half of what the College Board does involves making up and scoring tests. The other half is credentialing and ID management. In the second half, confidence is everything.

Biometrics are already very commonly used for graduate level admissions testing.

See also: Biometrics employed to crack down on proxy test takers

UPDATE:
ETS, the nonprofit that administers the SAT under the auspices of the College Board, told Newsday that it had no intentions of tightening security. (International Business Times via @M2SYS)

We talk (Return on Investment) ROI a lot here.

It's likely that biometric identity management for the SAT currently yields a negative ROI.

The GMAT, among other graduate admissions tests uses biometrics, but the graduate tests are a lot more expensive (GMAT $250; SAT $47). The SAT is taken by far more people and in a wider variety of locations (local high schools, etc.) while the graduate level exams are taken at professional testing centers facing different staff training and technology procurement incentives.

If the incidence of SAT cheating is sufficiently rare that the ETS is not losing credibility as a credentialing authority (i.e. colleges still trust them), it's not hard to see why they're planning to keep their current ID management procedures... for now.

UPDATE II (December 16, 2011):
"For now" may have lasted three months.

Is ETS Reconsidering its ID Management Practices? (CNN)

Even before the College Board receives recommendations from Freeh's security firm, it is weighing several new measures to stamp out impersonations.

The nonprofit is considering adjustments to the number and type of IDs it requires from test-takers, as well the use of digital photography in authenticating test-takers' identities, Caperton testified.

Other options it is likely to examine include palm-vein identification technology; fingerprinting, which is used on the LSAT exam; and requiring that students take the test at their own schools.

But in addressing the impersonation issue, the College Board may well create other problems.

If new ID requirements are perceived as a hassle, some students might decide not to take the test at all.

NHTSA Funds Alcohol-Measuring Biometric Car Start Button

msn.com & Autoweek

Takata, a safety and technology company, and TruTouch have created a vehicle start button with an integrated infrared sensor that can measure your blood-alcohol content. If the reading exceeds legal limits, the system can disable the starter. As the technology advances, it could help eliminate drunken driving, according to TruTouch. The system could be a reality within a decade.

One of the key tipping points for the whole biometrics field will be when insurance companies begin giving their customers discounts for adopting better ID management technology that reduces the risk of a claim.

China: E-payment booms (Guardian.co.uk)
Use your fingerprint to buy a bowl of noodles for half off at 10 yuan ($1.60).

Jakarta, Indonesia: 7 of city's 9 million residents expected to get biometric ID cards (The Jakarta Post)

Mauritania: Minorities not too keen on biometric census (AFP)

BBC Video About Facial Recognition

Facial recognition marks the end of anonymity (BBC)
That's a bold statement but the video is interesting as a survey of what Carnegie Mellon University is up to in biometrics applications and platforms.

It's a good video. Click on over there and give it a look. It even discusses the privacy/anonymity issue in terms that have a lot in common with a something we posted last week.

But about the PittPatt Technology using face recognition to discover Social Security Numbers (this links to a text article describing the first app featured in the video linked above)...

I'm not buying it.

What Alessandro Acquisti and his team have succeeded at is using a face as a search term in a search engine focused on Facebook. This is probably why Google bought the technology. It is an interesting and important development in its own right and something discussed here: Biometrics, object recognition and search.

But, using a photo of a face to find a Facebook page has zero, nothing to do with Social Security Numbers. An individual's birthday and place of birth, however, has a lot to do with their Social Security Number. See: Google yanks request for kids' social security numbers:

It is open to children from kindergarten through the last year of high school and requires that a contestant provide a Parent Consent Form along with their submission. The original form asked for the child’s city of birth, date of birth, the last four digits of the child’s social security number, and complete contact info for the parents.

Now that's how you get Social Security Numbers! Social engineering and a wide net, not covert efforts focused on individuals.

The only way the PittPatt technology could be useful in stealing an identity by trying to deduce a person's SSN is:
♦ The identity thief has identified a particular individual whose identity she wants to steal.
♦ The identity thief knows no other information about the mark, but she has a photo.
♦ The mark has stored private information (either the SSN itself, or the details that make it somewhat predictable) online in a publicly viewable way together with their photo.

Essentially, the photo just replaces the name as the search term. I've never heard of identity thieves doing their research by typing random names into a search engine and hoping for the best. This isn't how identity theft works and no rationally profit-maximizing identity thief would ever do something like that. It is far easier to search for Facebook profiles that share birthdate information than to sit around on the sidewalk taking pictures of people in the hope that (a) they have a Facebook account, and (b) it contains instructions on how to steal their identity.

Granted, as this type of search becomes more common, and it will, it won't just be Facebook that gets searched. But at most, the PittPatt project allows users to do a search for people without knowing their name.

The real problem is the importance, predictability and unchangeability of Social Security Numbers, not facial recognition.

India: Is UID Under Siege?

Is Nandan Nilekani's UID dream run over? (The Economic Times)

The reasons for the differences are many: territorial, civil liberties, intellectual, political and technological. Put it all together and it gives the impression that the Unique Identification Authority of India (UIDAI) - a novelty in the delivery of a government service - is under siege. From within the government. Nilekani shrugs it off as a "process of debate" natural to a project of such scale and transformational impact. "An important lesson I have learnt is that in the public space, there are a lot more stakeholders with different views," says the UIDAI chairman.

and

But another top UIDAI official, not wanting to be identified, points to motives in the guise of differences: "It is part skepticism, part vested interests."

The linked article gives an in-depth analysis of the bureaucratic and political forces at work in the implementation of India's UID program. Read the whole thing.

Identity management is about people. The people issues are always thornier than the technological problems. And, yes, UID will upset many applecarts. That's why it's important and that's why it will be hard.

Nandan Nilekani is the animating spirit of the UID project. He knows technology through education and experience among the founding generation of Unisys. He knows management, evidenced by his rise to become CEO of that firm. He knows India (inasmuch as India is "knowable"), having attended Indian schools at every level of his education and having lived in several places there. And he knows government through his service on various committees and advisory groups. He is, perhaps, the only person capable of pulling this off.

No matter how it all turns out, the subject will provide plenty of material for MBA and Political Science textbook writers for years.

There's a tendency when discussing big issues to focus on the big names. The linked article does it, as does this analysis. But we'll never know the names of the people to whom UID matters most. Those people can be seen in the wonderful photographs that accompany this article.

More on UID and Nandan Nilekani from The Atlantic. How to Count One-Sixth of the World's Population.

Kenya: Electronic Voting Is Still Six Years Away

Kenya will not yet implement electronic voting but would procure a platform for electronic voter registration for next year (AllAfrica.com)

"Any application of technology must increase administrative efficiency, reduce long-term costs and enhance political transparency. In the end, elections are about choices expressed in terms of results and those results acquire legitimacy only through unanimous or widespread acceptance".

It's important not to confuse biometric voter registration and verification with e-voting.

There are good reasons for adopting a biometric voter register while using a paper, or other physical balloting mechanism.

Background: Fighting Intensifies After Election in Kenya (New York Times - January 1, 2008)

A Critique of Pure Passwords...

...and a little advice on how to cope until they are finally made obsolete.

First the Critique:
Passwords shouldn't be simple, but this is getting ridiculous (Guardian.co.uk - John Naughton)

So I think of a really secure, incomprehensible password and type it in. The system rejects it as laughably inadequate. So I try another and another and another. Same result each time. At this point, I'm getting irritated.

Then, a helpful commenter directs us to the advice:

(Click to Enlarge) Source http://xkcd.com/ 

It's true. A 23 character password can be easier to remember than an 11 character password. The longer the password, however, the higher the likelihood of typographical errors and mis-keyed passwords.

Why Facial Recognition Time and Attendance?

Meant to improve hygiene, security (Green Bay Press Gazette)

"No worry about Big Brother watching you because everything is a digital template, not an actual image of the individual," he said. "FaceIN is touchless and hygienic. You just simply look at it. The bulk of our business is in health care business, food services, manufacturing, government and retail."

FaceIN product manager, Tony Burks, gets two very good points across in this brief quote.

Different modalities are suited to different applications and environments.

Template-only biometric time-and-attendance systems pose no privacy concerns that don't already exist in the employer/employee relationship.

Biometrics for Health Care Privacy, Efficiency and Safety

Hospitals embrace high-tech security

The next time a hospital official asks to look into your eyes, it might not be your health he's checking.

In South Florida and across the nation, hospitals are implementing high tech biometrics technology to speed up the admission process, reduce errors and add a layer of security in an age where insurance fraud and identity theft is a serious problem.

Increased (Efficiency + Safety + Privacy) = ROI

With the stakes so high, and the straightforward Return on Investment (ROI), it's no surprise that health care is rapidly adopting biometric identity management solutions.

Biometrics for Privacy Protection

Privacy and biomeric identity management techniques are often discused together. One side of the relationship, however, gets a lot more attention than the other. Biometrics have more potential to protect privacy than to undermine it.

80% of Americans worry about Electronic Health Record privacy (Fierce EMR via @M2SYS)

A major part of the concern involves human error and activity, such as lax access controls and inadequate security measures, SailPoint notes in the report.

"Consumers are right to be concerned about the possible exposure of their very private medical information," Jackie Gilbert, vice president of marketing and co-founder at SailPoint, said in a statement. "As the healthcare industry around the world moves toward digitalizing personal healthcare records, keeping patient information private and secure must be the highest priority. Healthcare organizations need to make sure that they have the proper controls in place to protect patient data; those that don't clearly risk lawsuits, fines, and most importantly, loss of patient trust."

Biometrics for logical access control are more protective of privacy than passwords.